The vulnerability resides in the UploadFirmwareFile routine of the cstecgi.cgi CGI handler on the router’s web interface. By manipulating the FileName argument, an attacker can inject operating‑system commands that are subsequently executed by the device’s firmware. This flaw permits remote execution of arbitrary code, allowing a threat actor to compromise the router’s confidentiality, integrity and availability.

Routers of the Totolink A7100RU series running firmware version 7.4cu.2313_b20191024 are affected. The flaw is located in the /cgi-bin/cstecgi.cgi file that processes firmware uploads.

The CVSS score of 9.3 indicates a high‑severity vulnerability. The EPSS score of 2% indicates a low but non‑negligible probability of exploitation, which, combined with the publicly available exploit and lack of mitigations, makes the risk significant. Based on the description, it is inferred that the attack vector is remote and that the vulnerability can be triggered via the publicly accessible web interface, though the input does not explicitly state authentication prerequisites. If exploited, the attacker gains full control of the device.