The vulnerability allows an attacker to inject arbitrary operating system commands through the maxRtrAdvInterval parameter of the setRadvdCfg function in the cstecgi.cgi CGI handler. This results in remote OS command execution and full compromise of the affected router, providing attackers with control over the device and any connected networks. The weakness is consistent with common command injection flaws.

Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024 are affected. No other versions or products are listed as vulnerable in the available data.

The vulnerability scores a CVSS of 9.3, indicating critical severity, and the exploit is publicly available, implying a high likelihood of exploitation. EPSS data is not provided, and the flaw is not yet listed in the CISA KEV catalog. Attackers can initiate the exploit remotely, and successful exploitation leads to complete loss of confidentiality, integrity, and availability of the device.