This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. An OS command injection flaw exists in the setPptpServerCfg function of the /cgi-bin/cstecgi.cgi CGI handler. By manipulating the 'enable' parameter, an unauthenticated remote attacker can execute arbitrary operating system commands on the device. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 9.3, indicating critical severity. The vulnerability was publicly disclosed on April 10, 2026. No official patch or vendor advisory is currently available, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services. The high CVSS score reflects the ease of exploitation and the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable service or restricting access to the device's management interface from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.