The vulnerability resides in the setWiFiBasicCfg function of the /cgi-bin/cstecgi.cgi CGI handler on Totolink A7100RU firmware 7.4cu.2313_b20191024. The attacker can supply a crafted value for the wifiOff parameter, which is passed directly to an operating‑system command line. This leads to an os command injection that results in remote code execution. The weakness is defined by CWE‑77 and CWE‑78.

Vendors affected include Totolink. The product impacted is the A7100RU router running firmware version 7.4cu.2313_b20191024. All devices that have not applied the vendor’s firmware update are susceptible.

The CVSS base score of 9.3 indicates critical severity, and the vulnerability has a known public exploit available. Although an EPSS score is not provided, the presence of a public exploit and the ability to trigger the injection remotely mean that the attack is likely to be attempted. The vulnerability is not currently listed in the CISA KEV catalog, but the risk remains high because it can allow attackers to gain full control over the device.