The Totolink A7100RU router firmware 7.4cu.2313_b20191024 contains an OS command injection vulnerability identified as CVE-2026-5688. The issue is located in the setDdnsCfg function within the /cgi-bin/cstecgi.cgi file. By manipulating the 'provider' argument, an attacker can inject and execute arbitrary operating system commands remotely without authentication. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. There is no vendor advisory or patch available at this time, and the vulnerability state is published with no remediation level specified.

Successful exploitation of this vulnerability allows remote unauthenticated attackers to execute arbitrary OS commands on the affected device. This can lead to compromise of the router, potentially affecting network security and device integrity. However, there are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation has been published, users should monitor Totolink's official channels for updates. Until a patch is available, restricting access to the router's management interface from untrusted networks may reduce exposure.