This vulnerability allows remote attackers to perform OS command injection by manipulating the FileName parameter in the UploadFirmwareFile function of the /cgi-bin/cstecgi.cgi CGI handler on Totolink A7100RU devices running firmware version 7.4cu.2313_b20191024. The vulnerability is unauthenticated and requires no user interaction, making it highly exploitable. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been disclosed by the vendor.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This could impact device confidentiality, integrity, and availability. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, affected users should consider disabling remote access to the device's management interface or restricting access to trusted networks only. Monitor vendor channels for updates and apply patches promptly once released.