This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue is an OS command injection in the setTelnetCfg function of the CGI Handler (/cgi-bin/cstecgi.cgi). By manipulating the telnet_enabled parameter, an unauthenticated remote attacker can inject and execute arbitrary operating system commands on the device. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. Exploit code has been publicly released, increasing the risk of exploitation. No official patch or vendor advisory is currently available, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary OS commands on the affected Totolink A7100RU device, potentially leading to full compromise of the router. This can impact device confidentiality, integrity, and availability. The high CVSS score reflects the critical nature of the flaw and the ease of exploitation. Public exploit code availability increases the likelihood of attacks. No known exploits in the wild have been confirmed yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management features if possible, restrict network access to the device, and monitor for unusual activity. Avoid exposing the device's management interface to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.