This vulnerability exists in the Totolink A7100RU router firmware 7.4cu.2313_b20191024, specifically in the setGameSpeedCfg function within the /cgi-bin/cstecgi.cgi script. By manipulating the 'enable' parameter, an attacker can perform OS command injection remotely without authentication. The vulnerability is rated medium severity with a CVSS 4.0 base score of 6.9, indicating network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. The exploit has been publicly disclosed, but no vendor patch or official remediation has been documented.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to unauthorized control or disruption of the router. The impact is rated medium severity based on the CVSS score and vector, reflecting moderate risk without requiring authentication or user interaction. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting remote access to the affected device and monitor for unusual activity. Avoid exposing the device's management interface to untrusted networks. Follow vendor channels for updates regarding patches or mitigations.