This vulnerability affects the Totolink A7100RU router running firmware 7.4cu.2313_b20191024. The issue is an OS command injection in the CGI Handler's setSyslogCfg function, triggered by improper sanitization of the 'enable' parameter in the /cgi-bin/cstecgi.cgi endpoint. This allows remote attackers to execute arbitrary operating system commands on the device without any privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity. Although an exploit is publicly available, there is no vendor-provided patch or official remediation information currently.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control over network traffic, device configuration, and could serve as a foothold for further attacks within the network. The high CVSS score reflects the ease of exploitation and the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management interfaces if enabled, restrict network access to the device's management interface, and monitor for unusual activity. Avoid exposing the device's CGI interface to untrusted networks. Follow up with Totolink for updates on official patches or mitigations.