A flaw in the setIpv6LanCfg function of the cstecgi.cgi handler on Totolink A7100RU routers allows attackers to inject arbitrary operating system commands through manipulation of the addrPrefixLen argument. This results in remote code execution with the privileges of the CGI process, exposing the device to complete compromise of confidentiality, integrity, and availability. The vulnerability carries a CVSS score of 9.3, indicating a very high severity that should be addressed with priority.

The vulnerability affects Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. The specific component at risk is the CGI interface located at /cgi-bin/cstecgi.cgi, which processes the setIpv6LanCfg command. Only devices running the affected firmware revision are vulnerable; newer or older firmware versions not explicitly listed are not confirmed to be impacted.

The flaw can be exploited remotely without authentication as the vulnerable CGI endpoint is publicly reachable. Public exploits have already been disclosed, and the absence of an EPSS score suggests a higher likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog, but the combination of a high CVSS score, existing public exploits, and remote access makes the risk substantial. An attacker can send a crafted HTTP request to the cstecgi.cgi endpoint, inject shell commands via the addrPrefixLen parameter, and gain full control over the router.