This vulnerability affects the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. It arises from insufficient input validation in the setWiFiGuestCfg function within the CGI Handler component, allowing an attacker to inject OS commands via the wifiOff parameter in the /cgi-bin/cstecgi.cgi endpoint. The vulnerability is remotely exploitable without any privileges or user interaction, leading to potential full system compromise. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been documented.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control over the device, disruption of network services, and compromise of network traffic passing through the router. The CVSS score of 9.3 reflects the critical nature of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the router's management interface from untrusted networks and monitor for any unusual activity. Avoid exposing the device's web management interface to the internet. Follow vendor communications closely for updates on patches or mitigations.