The flaw lies in the setLoginPasswordCfg handler of the router’s CGI interface. The admpass parameter is not sanitized and is passed directly to the operating system shell, allowing an attacker to inject arbitrary commands. This remote command injection can lead to full compromise of the device, enabling the attacker to read or modify firmware, install backdoors, or disrupt network traffic.

This vulnerability affects Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. The affected component is the CGI handler located at /cgi-bin/cstecgi.cgi. Other firmware releases containing the same code may also be vulnerable, but only this version has been confirmed.

The CVSS score of 9.3 denotes a critical severity. The exploit is publicly available and can be launched remotely through the web interface without authentication, simply by manipulating the admpass parameter. EPSS data is not available, but the combination of a high severity score and public exploit suggests a high likelihood of real‑world exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, yet the critical impact warrants immediate attention.