This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue resides in the CGI handler component, specifically in the setWiFiAclRules function of /cgi-bin/cstecgi.cgi. By manipulating the 'mode' parameter, an unauthenticated remote attacker can perform OS command injection, potentially leading to full system compromise. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no official patch or remediation level has been documented.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication, potentially leading to complete compromise of the router. This can affect device confidentiality, integrity, and availability. There are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management interfaces if enabled and restrict network access to the device to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.