This vulnerability allows an unauthenticated remote attacker to perform OS command injection via the tty_server parameter in the setAdvancedInfoShow function of the /cgi-bin/cstecgi.cgi component on Totolink A7100RU devices running firmware 7.4cu.2313_b20191024. The issue arises from insufficient input validation, enabling execution of arbitrary system commands. The CVSS 4.0 base score is 9.3 (critical), reflecting the ease of remote exploitation without privileges or user interaction and the high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but currently lacks an official fix or vendor advisory.

Successful exploitation can lead to full system compromise of the affected Totolink A7100RU device, allowing an attacker to execute arbitrary OS commands remotely without authentication. This can result in unauthorized control over the device, potentially affecting network security and availability. The high CVSS score indicates severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider disabling remote access to the device's management interface or isolating the device from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.