A security flaw exists in the setPptpServerCfg CGI on Totolink A7100RU routers. The ‘enable’ argument is improperly validated, making it possible for an unauthenticated attacker to inject arbitrary operating‑system commands. The flaw is a typical command injection vulnerability, classified under CWE‑77 and CWE‑78.

The affected devices are Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. Only the specific version listed in the vulnerability report is confirmed, but any device exposing the /cgi-bin/cstecgi.cgi endpoint could be vulnerable if the same code path remains.

The CVSS base score of 9.3 indicates a high‑severity, remote exploitation possibility. Because the exploit is publicly disclosed and can be triggered over the network with a crafted HTTP request, the risk is significant. While the EPSS score is not provided and the vulnerability is not yet in the KEV catalog, the combination of remote reachability and uncontrolled command execution makes mitigation a priority. Exploits do not require authentication and can be performed from any host that can reach the router’s management interface.