The flaw resides in the setVpnPassCfg function of the cstecgi.cgi component in Totolink A7100RU firmware 7.4cu.2313_b20191024. Manipulation of the pptpPassThru argument permits injection of arbitrary operating‑system commands, allowing an attacker to execute code with the privileges of the web server process. Because the vulnerability is an OS command injection (CWE‑77/78), it can compromise the confidentiality, integrity, or availability of the device and its network traffic, with the potential to take full control of the router.

This vulnerability affects only the Totolink A7100RU router model. The specific firmware revision that is vulnerable is 7.4cu.2313_b20191024. No other product variants or vendors are listed, so the scope is limited to this router and firmware build.

The CVSS v3 score of 9.3 indicates a critical severity. Although no EPSS score is published, publicly available exploit code suggests a realistic chance of exploitation. The attack can be launched remotely through the router’s web interface without local access or elevated privileges, enabling an attacker to run arbitrary commands on the host. The flaw is not currently in the CISA KEV catalog, but the combination of high severity and available exploits warrants urgent attention.