An OS command injection vulnerability exists in the setVpnAccountCfg function of the cstecgi.cgi CGI handler on the Totolink A7100RU router. An attacker can supply a specially crafted User parameter that allows arbitrary OS command execution on the router, potentially compromising its operating system and enabling full control over the device, including manipulation of network traffic, data exfiltration, and denial of service.

The vulnerability affects the Totolink A7100RU router, specifically firmware version 7.4cu.2313_b20191024. Any device running this firmware edition is susceptible to remote exploitation.

The flaw carries a CVSS score of 9.3, indicating critical severity. No EPSS score is provided, but the exploit is publicly known and actively used, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can reach the target remotely through the router’s publicly exposed management interface, likely without authentication, making it highly exploitable.