This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue lies in the setMiniuiHomeInfoShow function of the CGI Handler component, where improper input validation of the lan_info argument allows remote attackers to perform OS command injection via the /cgi-bin/cstecgi.cgi endpoint. The vulnerability enables unauthenticated remote code execution, posing a critical risk to affected devices. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation level is currently documented.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the router, including unauthorized control, data theft, or disruption of network services. The vulnerability is rated critical with a CVSS 4.0 score of 9.3. Although a public exploit exists, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management features if enabled, restrict network access to the device's management interface, and monitor for unusual activity. Avoid exposing the device's CGI interface to untrusted networks. Follow updates from Totolink for any forthcoming patches or official mitigations.