The vulnerability is an OS command injection in the setUrlFilterRules function of the /cgi-bin/cstecgi.cgi CGI handler. By manipulating the enable argument, an unauthenticated attacker can execute arbitrary shell commands on the device. This gives the attacker full control of the router, enabling compromise of confidentiality, integrity, and availability of the surrounding network.

The flaw exists in Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. Only this specific build is affected; other firmware revisions are not impacted.

The CVSS base score of 9.3 indicates critical severity, and the lack of mitigation in the public domain means attackers could exploit the flaw remotely without authentication. The exploit is publicly available, suggesting a high likelihood of real-world attacks. The vulnerability is not listed in the CISA KEV catalog, but the remote nature and high impact still warrant urgent remediation.