Affects the setGameSpeedCfg function in the cstecgi.cgi CGI script of the A7100RU router. The enable parameter can be manipulated to inject arbitrary operating system commands through the web interface. The vulnerability is a classic OS command injection, corresponding to CWE-77 and CWE-78. Remote attackers can invoke the injection from outside the host, potentially gaining the ability to execute any command on the router’s operating system, which may compromise confidentiality, integrity, and availability of the device and the network it protects.

Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024 are affected. This includes the cstecgi.cgi script located under /cgi-bin. No other vendor or product is currently listed as impacted.

The CVSS score of 6.9 indicates medium severity. Exploitability is increased by the fact that the attack vector is remote and no special user credentials are required; the exploit has already been made public. The EPSS score of < 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but if exploited, the command injection could allow arbitrary OS command execution, compromising the router and potentially the connected network.