The vulnerability allows an attacker to supply crafted input to the setSyslogCfg function within the /cgi-bin/cstecgi.cgi handler, which the firmware forwards directly to the underlying operating system shell. This leads to arbitrary command execution on the router. The weakness is an input validation failure that fails to neutralize shell metacharacters, categorized as command injection. An attacker who succeeds can gain full control of the device, compromising confidentiality, integrity, and availability of the network it serves.

Devices affected are Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. The flaw exists in the CGI Handler component exposed via the HTTP/HTTPS interface and does not appear to affect other firmware branches or products, though any device sharing the same CGI code base may be vulnerable if not updated.

With a CVSS base score of 9.3, this flaw is considered critical. The EPSS score is not published, and the vulnerability is not listed in the CISA KEV catalog, yet public exploit scripts exist, indicating that attackers can readily target exposed devices. The most likely attack vector is remote: an adversary only needs to send a specially crafted HTTP request to the cstecgi.cgi endpoint, assuming no network segmentation or access controls block the traffic.