This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The setPasswordCfg function in the CGI handler improperly sanitizes the admpass parameter, leading to OS command injection. An attacker can remotely execute arbitrary operating system commands by manipulating this parameter. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full compromise of the router. This can result in unauthorized control, data exposure, or disruption of network services. The vulnerability is critical with a CVSS score of 9.3, reflecting high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management features, restricting access to the device's management interface, or isolating the device from untrusted networks to reduce exposure. Monitor official Totolink channels for updates and apply patches promptly once available.