The vulnerability in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows a remote attacker to inject arbitrary operating system commands by manipulating the "enable" parameter of the setUPnPCfg function in /cgi-bin/cstecgi.cgi. This flaw, identified as a classic OS command injection (CWE‑77/78), can be triggered over the network, enabling the attacker to execute any command with the privileges of the router’s internal processes, effectively compromising the device’s confidentiality, integrity, and availability.

Affected devices include the Totolink A7100RU router — the specific firmware revision 7.4cu.2313_b20191024. The component in question is the CGI Handler accessible via /cgi-bin/cstecgi.cgi, and the vulnerability is tied to the enable argument within the setUPnPCfg function.

The CVSS base score of 9.3 indicates a severe risk. While EPSS data is not publicly available, the presence of public exploit code confirms that the vulnerability can be and has been used in the wild. The flaw is not listed in the CISA KEV catalog, but because the attack vector is remote, does not require authentication, and can be performed with a simple crafted HTTP request, the risk to exposed or unmanaged routers is significant.