The vulnerability resides in the setUnloadUserData function of the cgi-bin/cstecgi.cgi script on the Totolink A7000R router. By manipulating the plugin_name parameter, an attacker can inject arbitrary shell commands (CWE-74), enabling remote execution of code on the device (CWE-77). This results in full compromise of the router’s operating system, granting the attacker control over configuration, network traffic, and potentially other connected devices.

The affected product is the Totolink A7000R, specifically firmware version 4.1cu.4154. No other versions are indicated as vulnerable in the available data.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is less than 1 %, indicating a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. However, the publicly available exploit and the fact that the command can be injected via a web-accessible CGI script suggest a likely remote attack vector over the device’s HTTP interface. An attacker would need network access to the router or a valid session to submit the malicious plugin_name value.