The Totolink A7100RU router is vulnerable to an OS command injection flaw in the /cgi-bin/cstecgi.cgi CGI handler. Manipulating the enable argument of the setPortalConfWeChat function allows an attacker to inject arbitrary shell commands that are executed with the privileges of the router’s operating system. The flaw is the result of insufficient validation of input data and is identified as a command injection vulnerability (CWE‑77 and CWE‑78). Exploiting the flaw could result in complete compromise of the device, enabling disclosure of configuration, denial of service, or subsequent lateral movement within a network.

This vulnerability affects firmware version 7.4cu.2313_b20191024 of the Totolink A7100RU wireless router. Only devices running that specific firmware revision are directly impacted; other firmware versions are not known to contain the flaw.

The vulnerability has a CVSS score of 9.3, indicating extreme severity. The EPSS score of 3% indicates a modest but non-negligible probability of exploitation, and it is not listed in the CISA KEV catalog. An attacker can trigger the flaw remotely via the exposed endpoint, and publicly available exploit code suggests that the risk of exploitation is significant. The attack vector is network‑based, requiring only remote access to the device, and the flaw provides unauthorized command execution with system privileges.