This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The setTtyServiceCfg function in the CGI handler improperly sanitizes the ttyEnable parameter, enabling remote attackers to perform OS command injection. This allows execution of arbitrary commands on the underlying operating system with no privileges or user interaction required. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction. The exploit has been publicly disclosed but no known active exploitation has been reported. No patch or official remediation is currently available.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full system compromise. This can result in unauthorized control over the router, data theft, disruption of network services, or use of the device as a foothold for further attacks. The vulnerability requires no authentication and can be triggered remotely, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management interfaces if possible and restrict network access to the device's management services. Monitor vendor communications for updates and apply patches promptly once available.