The vulnerability resides in the UploadFirmwareFile routine of the cstecgi.cgi CGI handler on the router’s web interface. By manipulating the FileName argument, an attacker can inject operating‑system commands that are subsequently executed by the device’s firmware. This flaw permits remote execution of arbitrary code, allowing a threat actor to compromise the router’s confidentiality, integrity and availability.

Routers of the Totolink A7100RU series running firmware version 7.4cu.2313_b20191024 are affected. The flaw is located in the /cgi-bin/cstecgi.cgi file that processes firmware uploads.

The CVSS score of 9.3 indicates a high‑severity vulnerability. EPSS data is not available, but the public availability of an exploit and the lack of existing mitigations make the risk significant. The attack vector is remote, leveraging the publicly accessible web interface without authentication, so an adversary can trigger the vulnerability from an external network. If exploited, the attacker gains full control of the device.