The Totolink A7100RU router firmware 7.4cu.2313_b20191024 contains an OS command injection vulnerability in the CGI handler component, specifically in the setLedCfg function within /cgi-bin/cstecgi.cgi. By manipulating the 'enable' parameter, an unauthenticated remote attacker can execute arbitrary operating system commands on the device. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor as of the data provided.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can impact device confidentiality, integrity, and availability. The vulnerability is critical due to its ease of exploitation and high impact. There are no known exploits in the wild at this time, but public disclosure increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the device's management interface and monitor for unusual activity. Avoid exposing the device's CGI interface to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.