This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue is an OS command injection in the CGI handler component, specifically in the setTtyServiceCfg function processing the ttyEnable parameter. An attacker can remotely supply crafted input to this parameter to execute arbitrary operating system commands on the device. The vulnerability is remotely exploitable without privileges or user interaction, resulting in a high-severity security risk. The CVSS 4.0 base score is 9.3, indicating critical impact. No patch or official remediation information is currently available.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services. The vulnerability does not require authentication or user interaction, increasing its risk. However, no confirmed active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management features if possible or restricting access to the affected CGI interface. Monitor vendor channels for updates and apply patches promptly once available.