The vulnerability is an OS command injection flaw in the CsteSystem function of /cgi-bin/cstecgi.cgi on the Totolink A7100RU router. By manipulating the resetFlags argument, an attacker can execute arbitrary shell commands on the device, potentially taking full control or compromising network traffic. The flaw is exploitable remotely and has been publicly released.

Totals affected: Totolink routers of the A7100RU model, specifically firmware version 7.4cu.2313_b20191024. The vulnerability originates in the cstecgi.cgi CGI script deployed on the device.

The CVSS score is 6.9, indicating moderate severity. The EPSS score is not available, but the exploit is publicly available and not listed in the CISA KEV catalog, suggesting a non-zero likelihood of real-world attacks. Because the flaw is a command injection in a CGI script, it can be triggered by sending a crafted HTTP request to the device from the local or Internet network, making the attack vector remote. The impact is full system compromise, and the ease of exploitation is high when the device accepts input from untrusted sources.