This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue lies in the CGI handler component, specifically the setLoginPasswordCfg function in /cgi-bin/cstecgi.cgi. By manipulating the 'admpass' parameter, an attacker can perform OS command injection remotely without any privileges or user interaction. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data theft, or disruption of network services. The vulnerability is exploitable remotely without authentication, increasing the risk of widespread attacks. Although an exploit is publicly available, there are no known reports of exploitation in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider disabling remote management interfaces if possible or restricting access to trusted networks only. Monitor vendor communications for updates on patches or official mitigations.