The Totolink A7100RU router is vulnerable to an OS command injection flaw in the /cgi-bin/cstecgi.cgi CGI handler. By manipulating the enable argument of the setPortalConfWeChat function, an attacker can feed arbitrary shell commands into the device. Attackers can remotely trigger the flaw and execute code with the privileges of the router’s OS, leading to full compromise of the device, including disclosure of configuration, denial of service or further lateral movement. The flaw is critical, with a CVSS score of 9.3, indicating extreme severity.

The vulnerability exists in firmware version 7.4cu.2313_b20191024 of the Totolink A7100RU wireless router. Users of that specific firmware revision are directly affected and should verify the firmware version they are running.

The attack vector is remote; the exploit code has been made publicly available, and the vulnerability has been assigned a very high CVSS score. No EPSS score is listed and the flaw is not yet in the CISA KEV catalog, but the public availability of exploit code means that the risk of exploitation is significant. An attacker who reaches the setPortalConfWeChat endpoint can readily deliver arbitrary commands for execution.