This vulnerability affects Totolink A7100RU firmware 7.4cu.2313_b20191024. The setDmzCfg function in the CGI handler improperly sanitizes the wanIdx parameter, enabling remote attackers to perform OS command injection. This allows execution of arbitrary commands on the device with no privileges or user interaction required. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction needed, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data exposure, or disruption of network services. The vulnerability is critical due to its ease of exploitation and high impact on device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's management interface from untrusted networks and monitor for suspicious activity. Avoid exposing the device's CGI interfaces to the internet. Follow vendor updates closely for any released patches or mitigations.