This vulnerability affects the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It is caused by improper input validation in the setAppCfg function of the /cgi-bin/cstecgi.cgi CGI handler, allowing remote attackers to inject and execute arbitrary OS commands via the 'enable' parameter. The vulnerability is remotely exploitable without authentication, leading to potential full system compromise. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the router, including unauthorized control, data theft, or disruption of network services. The high CVSS score reflects the critical nature of this vulnerability and its potential to severely impact device security and network integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to limit network exposure of the affected device, especially restricting access to the /cgi-bin/cstecgi.cgi interface. Network-level controls such as firewall rules or VPN access can help reduce the attack surface. Monitor vendor communications for updates and apply patches promptly once available.