This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The setAccessDeviceCfg function in the CGI handler improperly sanitizes the mac argument, enabling remote OS command injection. The attack vector is network-based with no required privileges or user interaction, resulting in a high-severity critical vulnerability with a CVSS 4.0 base score of 9.3. Exploit code is publicly available, increasing the risk of exploitation. No official remediation or patch has been disclosed by Totolink, and the device is not a cloud service, so remediation depends on vendor firmware updates.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication, potentially leading to full device compromise. This could result in unauthorized control over the router, interception or manipulation of network traffic, and disruption of network services. The high CVSS score reflects the critical nature of this vulnerability and the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official firmware update is released by Totolink, affected users should consider disabling remote management features if enabled and restrict network access to the device's management interface. Monitor vendor communications for updates and apply patches promptly once available.