This vulnerability affects the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue is located in the CGI handler component, specifically the setNetworkCfg function within /cgi-bin/cstecgi.cgi. By manipulating the 'proto' parameter, an unauthenticated remote attacker can perform OS command injection, potentially gaining control over the device. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the exploit is publicly known.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can impact the confidentiality, integrity, and availability of the device and the network it supports. The vulnerability is critical due to its remote exploitability and high impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the device's management interface from untrusted networks and monitor for unusual activity. Avoid exposing the device's CGI interface to the internet. Follow vendor communications closely for updates on patches or mitigations.