The Totolink A7100RU router firmware 7.4cu.2313_b20191024 contains an OS command injection vulnerability in the CGI handler component, specifically in the setIptvCfg function within /cgi-bin/cstecgi.cgi. Manipulating the igmpVer parameter allows an unauthenticated remote attacker to execute arbitrary operating system commands on the device. This vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided by the vendor as of the published date.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full compromise of the router. This can impact device confidentiality, integrity, and availability. The vulnerability is critical with a CVSS score of 9.3. Although an exploit is publicly available, there are no reports of exploitation in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling affected services or restricting network access to the device's management interface to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.