This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The setAdvancedInfoShow function in the CGI handler (/cgi-bin/cstecgi.cgi) improperly handles the tty_server argument, enabling remote OS command injection. The CVSS 4.0 base score is 9.3, reflecting its critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no vendor patch or mitigation guidance is currently documented.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the router, including unauthorized access, control over network traffic, and potential pivoting to internal networks. The high CVSS score indicates severe impact on confidentiality, integrity, and availability of the device and connected networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting remote access to the device's management interface and monitor for unusual activity. Avoid exposing the device's CGI interface to untrusted networks. Follow vendor channels for updates and apply patches promptly once available.