This vulnerability involves an OS command injection in the Totolink A7100RU router firmware 7.4cu.2313_b20191024. Specifically, the setStorageCfg function in the CGI handler (/cgi-bin/cstecgi.cgi) improperly handles the sambaEnabled parameter, enabling remote attackers to inject and execute arbitrary operating system commands. The attack vector is network-based with no required privileges or user interaction, resulting in a high-severity risk. The CVSS 4.0 base score is 9.3, reflecting critical impact due to remote code execution potential. No official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full compromise of the router. This could enable attackers to control network traffic, intercept data, or launch further attacks within the network environment. The vulnerability is critical given the ease of exploitation and the high privileges gained.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management features if possible and restrict network access to the device's management interface to trusted hosts only. Monitor vendor channels for updates and apply patches promptly once available.