This vulnerability affects the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue lies in the CGI handler component, specifically the setWiFiBasicCfg function in /cgi-bin/cstecgi.cgi. By manipulating the wifiOff parameter, an attacker can perform OS command injection remotely without authentication. The CVSS v4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor patch or official remediation has been disclosed, and the device is not a cloud service, so remediation depends on vendor firmware updates.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary operating system commands on the affected device. This can lead to full compromise of the router, including control over network traffic, potential data interception, and disruption of network services. The vulnerability has a critical CVSS score of 9.3, reflecting its high impact on device security and network integrity. Although an exploit is publicly available, there are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been provided by Totolink, users should monitor vendor communications for firmware updates addressing this issue. Until a patch is available, consider restricting remote access to the device's management interface and disabling any unnecessary remote management features to reduce exposure.