This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue lies in the setLoginPasswordCfg function of the CGI handler component, specifically in the /cgi-bin/cstecgi.cgi file. By manipulating the 'admpass' parameter, an attacker can inject OS commands remotely, leading to command execution on the device. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication, potentially leading to full compromise of the router. This can impact confidentiality, integrity, and availability of the device and the network it serves. The vulnerability is critical due to its ease of exploitation and high impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interface from untrusted networks and consider disabling remote management features if possible. Monitor vendor channels for updates and apply patches promptly once available.