The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 contains an OS command injection vulnerability identified as CVE-2026-5691. This vulnerability exists in the setFirewallType function within the /cgi-bin/cstecgi.cgi endpoint. By manipulating the firewallType parameter, an unauthenticated remote attacker can inject and execute arbitrary operating system commands on the device. The vulnerability has been publicly disclosed, increasing the risk of exploitation, but no official fix or patch has been announced. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality, integrity, and availability impact.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary OS commands on the affected Totolink A7100RU device. This could lead to unauthorized control over the device, potentially impacting its confidentiality, integrity, and availability. However, the CVSS score and vector indicate the impact on confidentiality, integrity, and availability is low. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting remote access to the device's management interface and monitor for unusual activity. Avoid exposing the device's administrative interfaces to untrusted networks. Follow updates from Totolink for any forthcoming patches or official mitigations.