This vulnerability affects Totolink A7100RU routers running firmware 7.4cu.2313_b20191024. An OS command injection flaw exists in the CGI Handler's setStorageCfg function via the sambaEnabled parameter in /cgi-bin/cstecgi.cgi. Because the vulnerability can be triggered remotely without authentication, it allows attackers to execute arbitrary operating system commands on the affected device. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Public exploit code is available, but no official patch or vendor advisory has been published to date.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected router, potentially leading to full compromise of the device. This can result in unauthorized control, data theft, or disruption of network services. The vulnerability has a critical severity rating with a CVSS 4.0 score of 9.3, reflecting its high impact and ease of exploitation.

No official patch or remediation guidance is currently available from Totolink. Users should monitor the vendor's website and security advisories for updates or firmware patches addressing this vulnerability. Until a fix is released, consider isolating the affected device from untrusted networks or disabling remote management features if possible to reduce exposure.