This vulnerability exists in the Totolink A7100RU router firmware 7.4cu.2313_b20191024 within the CGI handler component. Specifically, the setVpnAccountCfg function improperly handles the User argument, leading to OS command injection. This allows an unauthenticated remote attacker to execute arbitrary operating system commands on the device. The CVSS 4.0 base score is 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation enables remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full compromise of the router, including data theft, device control, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the device and connected network traffic.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interface from untrusted networks and consider disabling vulnerable services if possible. Monitor vendor channels for updates and apply patches promptly once available.