This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue lies in the CGI handler component, specifically the setWiFiAclRules function in /cgi-bin/cstecgi.cgi. By manipulating the 'mode' parameter, an attacker can inject OS commands remotely without any privileges or user interaction. The vulnerability has been publicly disclosed and carries a CVSS 4.0 score of 9.3, indicating critical severity. No official patch or remediation level has been documented by the vendor, and the product is not a cloud service, so remediation depends on vendor firmware updates.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control over network traffic, device configuration, and further network attacks. The vulnerability requires no authentication and no user interaction, increasing its risk. However, there are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor Totolink's official channels for firmware updates addressing this issue. Until a patch is available, consider restricting remote access to the router's management interface and disabling any unnecessary remote management features to reduce exposure.