This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. It arises from improper input handling in the setUrlFilterRules function of the CGI Handler, allowing remote attackers to inject and execute arbitrary operating system commands via the 'enable' parameter. The vulnerability is remotely exploitable without authentication, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The CVSS v4.0 base score is 9.3, reflecting critical severity. Although the exploit is publicly available, there is no vendor advisory or patch information currently provided.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without any privileges or user interaction. This could lead to full compromise of the router, enabling control over network traffic, data interception, or further attacks on connected systems. The availability of a public exploit increases the likelihood of attacks, but no confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the device's management interface from untrusted networks and monitor for unusual activity. Avoid exposing the router's CGI interface to the internet. Follow updates from Totolink for any official patches or mitigation instructions.