This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue is located in the CGI handler component, specifically the setWizardCfg function in /cgi-bin/cstecgi.cgi. By manipulating the 'wizard' argument, an attacker can perform OS command injection remotely without any privileges or user interaction. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, indicating high impact and ease of exploitation. No vendor advisory or patch information is currently available, and the exploit code has been publicly disclosed.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control over network traffic, device configuration, and further attacks on connected systems. The vulnerability requires no authentication and no user interaction, increasing the risk of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider disabling remote management interfaces if possible or isolate the device from untrusted networks to reduce exposure. Monitor official Totolink channels for updates and apply patches promptly once available.