This vulnerability involves an OS command injection in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. Specifically, the setRemoteCfg function in the /cgi-bin/cstecgi.cgi script improperly handles the 'enable' argument, allowing an attacker to inject arbitrary OS commands remotely without authentication. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and partial impacts on confidentiality, integrity, and availability. Although an exploit is publicly available, no vendor patch or official remediation has been disclosed.

Successful exploitation allows a remote attacker to execute arbitrary OS commands on the affected device without authentication, potentially compromising the device's confidentiality, integrity, and availability. This could lead to unauthorized control over the router and disruption of network services. However, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict remote access to the device management interface and monitor for suspicious activity related to the vulnerable endpoint. Avoid exposing the device's management CGI interface to untrusted networks.