This vulnerability allows remote attackers to perform OS command injection via the pptpPassThru parameter in the setVpnPassCfg function of the CGI Handler component on Totolink A7100RU devices running firmware 7.4cu.2313_b20191024. The vulnerability is exploitable without any privileges or user interaction, resulting in high impact on confidentiality, integrity, and availability. The CVSS 4.0 base score is 9.3, indicating critical severity. No vendor advisory or patch information is currently available, and the device is not a cloud service.

Successful exploitation enables remote attackers to execute arbitrary operating system commands on affected devices, potentially leading to full compromise of the router. This can result in unauthorized control, data exposure, or disruption of network services. The vulnerability requires no authentication and no user interaction, increasing the risk of exploitation. Although an exploit is publicly available, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling vulnerable services or restricting access to the device's management interface from untrusted networks. Monitor Totolink's official channels for updates and apply firmware updates promptly once available.