The vulnerability resides in the setTelnetCfg function of the cstecgi.cgi script on Totolink A7100RU routers. An attacker can manipulate the telnet_enabled parameter to inject arbitrary OS commands. Successful exploitation gives full control over the device’s operating system, allowing data theft, device takeover, or further network compromise.

The flaw affects the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. No other firmware revisions are listed in the CNA data; systems running this specific build are therefore at risk.

With a CVSS score of 9.3 the vulnerability is high severity. The EPSS score is not available, but the publicly released exploit and absence from the KEV catalog do not mitigate its danger. The attack vector is remote, using crafted HTTP requests to the CGI handler; no special privileges are required, and any host able to reach the router’s management interface can exploit the flaw.