The vulnerability allows a remote attacker to inject operating system commands through the "enable" parameter of the /cgi-bin/cstecgi.cgi setLedCfg function. This exploitation can lead to full control of the device, compromising confidentiality, integrity, and availability of the affected router.

The flaw is present in Totolink routers model A7100RU running firmware 7.4cu.2313_b20191024. Users of this firmware variant are directly exposed to the risk if the router is accessible from the network.

With a CVSS score of 9.3, the vulnerability poses a high severity risk. Although an EPSS score is not provided, the publicly disclosed exploit indicates that the issue is actively leveraged in the wild. The attack vector is remote, likely via an unauthenticated HTTP request to the CGI endpoint. The absence from the CISA KEV catalog does not diminish the need for immediate remediation.