This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue is located in the setNtpCfg function of the /cgi-bin/cstecgi.cgi CGI script. By manipulating the tz parameter, an attacker can perform OS command injection remotely without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, reflecting network attack vector, low complexity, no privileges required, and no user interaction. No official patch or remediation level has been published by the vendor, and the exploit code is publicly available.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the affected device. This can lead to compromise of the router, potentially enabling control over network traffic or further attacks on internal networks. The vulnerability's medium severity reflects the significant impact but relatively low complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management interfaces if enabled and restrict access to the device's management interface to trusted networks only. Monitor vendor communications for updates on patches or official mitigations.