This vulnerability involves an OS command injection in the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue is located in the setMiniuiHomeInfoShow function within the CGI Handler component, where improper handling of the lan_info argument allows remote attackers to execute arbitrary operating system commands. The vulnerability is remotely exploitable without authentication or user interaction, and a public exploit exists. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full system compromise. This can result in unauthorized control over the router, disruption of network services, data interception, or further attacks on connected networks. The availability of a public exploit increases the likelihood of active exploitation attempts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published by Totolink as of the vulnerability disclosure date. Until a patch is available, affected users should consider restricting access to the device's management interface from untrusted networks and monitor for unusual activity. Follow official Totolink channels for updates on remediation.