The Totolink A7100RU router firmware 7.4cu.2313_b20191024 contains an OS command injection vulnerability in the setNtpCfg function of /cgi-bin/cstecgi.cgi. By manipulating the tz argument, an attacker can inject arbitrary OS commands remotely without requiring privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation guidance has been published by the vendor as of the vulnerability disclosure date.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to unauthorized control or disruption of the router. The vulnerability requires no privileges or user interaction but has low to limited scope and impact as indicated by the CVSS vector. There are no known exploits in the wild at this time, but a public exploit exists.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, network administrators should consider restricting access to the router's management interface from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.