This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue resides in the CGI handler component, specifically the setUPnPCfg function in /cgi-bin/cstecgi.cgi. By manipulating the 'enable' argument, an unauthenticated remote attacker can perform OS command injection, potentially leading to full system compromise. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the device is not a cloud service, so remediation depends on vendor action.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary operating system commands on the affected device, potentially leading to complete compromise of the router. This can impact confidentiality, integrity, and availability of the device and any network traffic passing through it. The vulnerability has a critical severity with a CVSS score of 9.3. Although an exploit is publicly available, there is no indication of widespread exploitation in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor Totolink's official channels for updates. Until a patch is available, consider isolating the affected device from untrusted networks to reduce exposure. Avoid exposing the device's management interface to the internet. Do not rely on generic mitigations beyond these specific recommendations.