This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024 in the CGI handler component. Specifically, the setAppCfg function in /cgi-bin/cstecgi.cgi improperly handles the 'enable' argument, allowing an attacker to inject OS commands remotely. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly known and an exploit is published, but no vendor patch or official remediation level is currently documented.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can impact device confidentiality, integrity, and availability. The high CVSS score reflects the critical nature of this vulnerability. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider disabling remote management features or restricting access to the device's management interface to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.