This vulnerability exists in the Totolink A7100RU router firmware 7.4cu.2313_b20191024 within the CGI handler component, specifically the setWiFiGuestCfg function. By manipulating the wifiOff parameter, an attacker can perform OS command injection remotely, leading to potential full system compromise. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor patch or official remediation level is currently documented.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the router, including unauthorized control, data theft, or disruption of network services. The vulnerability is critical due to its ease of exploitation and high impact on device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the device's management interface from untrusted networks and monitor for suspicious activity. Avoid exposing the router's web interface to the internet. Follow updates from Totolink for any forthcoming patches or official mitigations.