This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue is an OS command injection in the CGI Handler's setPortalConfWeChat function, triggered by manipulation of the 'enable' argument in the /cgi-bin/cstecgi.cgi endpoint. The vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands on the device. The CVSS 4.0 base score is 9.3, reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official fix or patch has been documented in the provided data, and the exploit code is publicly available.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full compromise of the router. This can result in unauthorized control, data exposure, or disruption of network services relying on the device. The vulnerability is critical due to its ease of exploitation and high impact on device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote access to the affected CGI interface if possible or isolate the device from untrusted networks to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.