This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The setNetworkCfg function in the /cgi-bin/cstecgi.cgi CGI handler improperly sanitizes the 'proto' argument, enabling an attacker to perform OS command injection remotely. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the exploit is publicly known.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the router, including unauthorized control, data interception, or disruption of network services. The vulnerability poses a critical risk to affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, affected users should consider disabling remote management interfaces if possible or isolating the device from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.