This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue lies in the CGI handler component, specifically the setTelnetCfg function in /cgi-bin/cstecgi.cgi. By manipulating the telnet_enabled parameter, an attacker can perform OS command injection remotely without any privileges or user interaction. This allows execution of arbitrary commands on the underlying operating system, posing a critical security risk. The vulnerability has been publicly disclosed and an exploit is available, increasing the risk of active exploitation. No official fix or patch has been confirmed by the vendor as of the published date.

Successful exploitation enables remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full system compromise. This can result in unauthorized control over the router, disruption of network services, and further attacks on connected systems. The high CVSS score reflects the ease of exploitation and the severity of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict network access to the device's management interface, disable Telnet if possible, and monitor for unusual activity. Avoid exposing the device to untrusted networks. Follow updates from Totolink for any released patches or official mitigation instructions.