This vulnerability affects the Totolink A7100RU router running firmware 7.4cu.2313_b20191024. The issue is located in the CGI handler component, specifically in the setWiFiBasicCfg function. By manipulating the wifiOff parameter, an attacker can perform OS command injection remotely without authentication. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official fix or mitigation has been documented, and the device is not a cloud service, so remediation depends on vendor action or user intervention.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the router, including potential control over network traffic, data interception, or further network attacks. The vulnerability severely impacts confidentiality, integrity, and availability of the device and connected networks. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, consider isolating the affected device from untrusted networks or disabling remote management features if possible to reduce exposure.