This vulnerability affects the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue lies in the CGI handler component, specifically the setIpv6LanCfg function in /cgi-bin/cstecgi.cgi. By manipulating the addrPrefixLen parameter, an attacker can perform OS command injection remotely without any privileges or user interaction. The vulnerability has been publicly disclosed and carries a CVSS 4.0 score of 9.3, indicating critical severity. No official patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands on the affected device. This can lead to full compromise of the router, including unauthorized control, data interception, or further network attacks. The vulnerability's critical severity reflects the potential for significant impact on device confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting remote access to the router's management interface and monitor for unusual activity. Avoid exposing the device's CGI interface to untrusted networks. Follow vendor channels closely for updates or patches addressing this vulnerability.