A remote attacker can inject operating‑system commands by manipulating the wanIdx parameter in the setDmzCfg function of /cgi-bin/cstecgi.cgi on a Totolink A7100RU router. This flaw is present in firmware version 7.4cu.2313_b20191024 and is characterized by CWE‑77 and CWE‑78 weaknesses. Successful exploitation would allow the attacker to run arbitrary OS commands on the device, potentially compromising the router’s functionality.

The vulnerability affects Totolink A7100RU routers running firmware 7.4cu.2313_b20191024. No other manufacturers or product variants are listed, so users of this specific router model and firmware should verify whether their device is affected.

The issue carries a CVSS score of 9.3, indicating critical severity. The description states that the attack may be performed remotely and that a publicly available exploit exists. The exact requirements for exploitation, such as authentication or user roles, are not specified in the CVE data, so the likelihood of exploitation depends on the router’s external exposure. The vulnerability is not yet in the CISA KEV catalog, but its critical score and availability of exploits raise concern.