This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue lies in the CGI Handler's setPortalConfWeChat function, where improper validation of the 'enable' argument leads to OS command injection. An attacker can remotely send crafted requests to the /cgi-bin/cstecgi.cgi endpoint to execute arbitrary commands on the underlying operating system. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the router, including unauthorized control, data manipulation, or disruption of service. The vulnerability poses a critical risk to the confidentiality, integrity, and availability of the device and potentially the network it serves.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the device's management interfaces from untrusted networks and monitor for suspicious activity targeting the /cgi-bin/cstecgi.cgi endpoint. Avoid exposing the router's web management interface to the internet. Follow vendor communications closely for updates on patches or official mitigations.