The Totolink A7100RU router firmware 7.4cu.2313_b20191024 contains an OS command injection vulnerability in the UploadOpenVpnCert function of the /cgi-bin/cstecgi.cgi CGI handler. Manipulation of the FileName parameter allows an unauthenticated remote attacker to execute arbitrary OS commands on the device. This vulnerability is classified as critical with a CVSS 4.0 base score of 9.3, reflecting its ease of exploitation and potential impact. No official fix or patch has been confirmed as of the publication date. The vulnerability is publicly disclosed but no known exploits in the wild have been reported.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary operating system commands on the affected device. This can lead to full compromise of the router, including unauthorized control, data interception, or disruption of network services. The high CVSS score indicates a severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling vulnerable functionality if possible or isolate the device from untrusted networks to reduce exposure. Monitor vendor communications for updates on patches or mitigations.