The flaw is an OS command injection vulnerability that resides in the setAppCfg function of the cstecgi.cgi CGI handler. An attacker can manipulate the enable parameter to cause the router to execute arbitrary system commands, which results in full remote code execution and complete takeover of the device. This weakness corresponds to command injection (CWE‑77) and operating‑system command injection (CWE‑78).

The vulnerability affects Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. No other firmware releases are documented as impacted, and no additional vendors or product lines appear to be affected in the advisory.

The vulnerability has a CVSS base score of 9.3, indicating critical severity. It can be exploited remotely over the network by sending a malicious enable parameter value to /cgi-bin/cstecgi.cgi. An exploit has already been published and demonstrated, meaning the flaw is actively used by threat actors. While the EPSS score is not available, the high CVSS, public exploit, and lack of privilege restrictions make the risk considerable. The vulnerability is not yet listed in the CISA KEV catalog, but that does not lessen the urgency of remediation.