This vulnerability concerns an OS command injection in the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue arises from the setAccessDeviceCfg function in the /cgi-bin/cstecgi.cgi CGI handler, where the 'mac' parameter is not properly sanitized, enabling remote attackers to inject and execute arbitrary operating system commands. The attack vector is network-based and requires no privileges or user interaction. The CVSS 4.0 base score is 9.3, indicating critical severity. No official patch or remediation level is currently documented, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full system compromise. This can result in unauthorized control over the router, disruption of network services, and further attacks within the network environment. The vulnerability is critical due to its remote, unauthenticated nature and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor Totolink's official channels for updates. Until a patch is available, restricting access to the device's management interface from untrusted networks and disabling remote management features, if possible, may reduce exposure.