This vulnerability in Totolink A7100RU firmware 7.4cu.2313_b20191024 involves an OS command injection in the setIpQosRules function of the /cgi-bin/cstecgi.cgi CGI Handler. The issue stems from improper sanitization of the 'Comment' parameter, which can be manipulated by remote attackers to execute arbitrary operating system commands. The vulnerability requires no privileges or user interaction and has a critical CVSS 4.0 score of 9.3, indicating a high potential impact. Although the exploit code has been publicly disclosed, no official patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full compromise of the router. This can impact device integrity, confidentiality, and availability. Given the critical severity and remote exploitability, affected devices are at significant risk if exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the device's management interface from untrusted networks and consider disabling or limiting CGI functionality if possible. Monitoring for vendor updates is strongly recommended.