Technical impact
The vulnerability is a command injection flaw in the setAppCfg function of the cstecgi.cgi CGI handler, which accepts an enable parameter that is passed directly to the operating system. An attacker can construct a malicious value for this parameter, causing the router to execute arbitrary shell commands. Such an exploit grants full control over the device, allowing an attacker to achieve any malicious objective that the router can perform. This weakness aligns with executive command injection (CWE-77) and operating‑system command injection (CWE-78).
Affected Systems
The flaw affects Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. No other device models or firmware releases are listed in the advisory as impacted.
Risk and Exploitability
The vulnerability carries a CVSS base score of 9.3, classifying it as critical, and an EPSS score of 2%, indicating a moderate likelihood of exploitation. The attack vector is remote, with no user interaction or local privilege required, and the flaw has been publicly demonstrated in the wild. Although it is not yet catalogued in the CISA KEV list, the high severity and availability of an exploit mean that the risk remains significant for affected deployments.
