This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue lies in the CGI handler component, specifically the setUrlFilterRules function in /cgi-bin/cstecgi.cgi. By manipulating the 'enable' argument, an attacker can perform OS command injection remotely without authentication or user interaction. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, and no privileges required. No official patch or vendor advisory is currently available, and the exploit code has been publicly disclosed.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the affected device, potentially leading to full system compromise. This can result in unauthorized control over the router, disruption of network services, and further attacks on connected systems. The vulnerability is critical due to its remote, unauthenticated nature and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the router's management interface from untrusted networks and monitor for any suspicious activity. Avoid exposing the device's CGI interface to the internet. Follow up with Totolink for updates on patches or official mitigations.