This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue lies in the CGI handler component, specifically the setWiFiEasyCfg function in /cgi-bin/cstecgi.cgi. By manipulating the 'merge' argument, an attacker can perform OS command injection remotely, enabling execution of arbitrary commands on the device. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data theft, or disruption of network services. The vulnerability requires no authentication and no user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting remote access to the device's management interface and monitoring for suspicious activity. Avoid exposing the device's CGI interface to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.