This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313. The setWanCfg function in the CGI handler improperly sanitizes the pppoeServiceName parameter, allowing an attacker to inject arbitrary OS commands remotely. The CVSS 4.0 base score is 9.3 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can impact confidentiality, integrity, and availability of the device and the network it serves. The availability of a public exploit increases the risk of attacks, although no active exploitation in the wild has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management interfaces if enabled, restrict network access to the device's management interface, and monitor for unusual activity. Avoid exposing the device to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.