The vulnerability exists in the setNtpCfg function of Totolink A7100RU firmware 7.4cu.2313_b20191024, where manipulating the tz argument in /cgi-bin/cstecgi.cgi allows an attacker to inject arbitrary operating‑system commands. This results in remote code execution, giving an attacker the ability to read, modify or delete data, disrupt service, or use the device as a foothold for further attacks. The weakness is a classic OS command injection, as noted by the related CWE identifiers.

Totolink routers with the A7100RU model running firmware version 7.4cu.2313_b20191024. No other products or firmware versions are explicitly listed as affected.

The CVSS score of 6.9 reflects a moderate severity, and the vulnerability is not listed in KEV, though the exploit is publicly available. The EPSS score of 1% indicates a very low but non‑zero probability of exploitation, yet the publicly available exploit and lack of authentication make the risk significant when the device is reachable. Because the flaw is accessed through a web‑based CGI endpoint, any user with network reachability to the device can exploit it without authentication. If the router is exposed to the Internet or the local network is not properly segmented, the risk of exploitation is high. Mitigation requires either applying the vendor’s firmware update or restricting network access to the vulnerable endpoint.