The vulnerability resides in the setIptvCfg function within the cstecgi.cgi component of the Totolink A7100RU firmware. A malformed igmpVer parameter can be exploited to inject arbitrary operating system commands, enabling an attacker to execute code with the privileges of the web process. This type of flaw corresponds to CWE-77 (OS Command Injection) and CWE-78 (Command Injection) and can result in full compromise of the device’s operating environment, jeopardizing confidentiality, integrity, and availability of the router and any connected networks.

Affected systems are Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. The flaw is exercised through the /cgi-bin/cstecgi.cgi CGI handler that processes IPTV configuration requests.

The vulnerability is rated at CVSS 9.3, indicating a high severity level. No EPSS score is publicly available, and the flaw is not listed in the CISA KEV catalog, though an exploit has been released to the public. The attack vector is remote, reachable from outside the local network, and requires no special authentication. Given the public availability of the exploit, the risk of real‑world exploitation is significant.