This vulnerability exists in the Totolink A7100RU router firmware 7.4cu.2313_b20191024, specifically in the setTracerouteCfg function of the /cgi-bin/cstecgi.cgi CGI handler. By manipulating the 'command' parameter, an unauthenticated remote attacker can perform OS command injection, potentially executing arbitrary commands on the device. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly known, but no vendor patch or official remediation has been documented.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the router, including control over network traffic and potential pivoting to internal networks. The critical CVSS score reflects the high risk of impact on confidentiality, integrity, and availability of the device and connected networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the device's management interface from untrusted networks and monitor for suspicious activity. Avoid exposing the device's CGI interfaces to the internet. Follow vendor channels for updates regarding patches or official mitigations.