A weakness in the setUploadUserData function of Totolink A7000R’s cstecgi.cgi allows an attacker to inject arbitrary commands via the FileName argument. This leads to execution of malicious code on the device, potentially granting full control over the router and enabling further compromise of the network.

The vulnerability affects Totolink A7000R models running firmware version 4.1cu.4154.

The CVSS score of 5.3 indicates a moderate severity, while an EPSS score of 6% shows that the vulnerability is considered likely to be exploited. The flaw is not listed in the CISA KEV catalog, but a publicly available exploit demonstrates that remote attackers can leverage it from outside the local network. The attack path requires an HTTP request to the vulnerable CGI script; however, whether authentication is required is not explicitly confirmed in the available data, making it a significant risk for unmanaged routers exposed to the internet.