This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. It arises from insufficient input validation in the UploadFirmwareFile function of the /cgi-bin/cstecgi.cgi CGI handler, allowing an attacker to inject OS commands via the FileName parameter. The vulnerability is remotely exploitable without authentication, making it highly critical. The CVSS 4.0 base score is 9.3, reflecting its network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can lead to full remote compromise of the affected device, including execution of arbitrary operating system commands. This can result in unauthorized control over the router, potentially allowing attackers to disrupt network operations, intercept or manipulate traffic, or use the device as a foothold for further attacks. Given the critical CVSS score and remote unauthenticated exploitability, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, network defenders should consider restricting access to the device's management interface from untrusted networks and monitor for suspicious activity targeting the /cgi-bin/cstecgi.cgi endpoint. No official or temporary fixes have been documented at this time.