The vulnerability resides in the setWanCfg function located in /cgi-bin/cstecgi.cgi on the Totolink A7100RU firmware version 7.4cu.2313. By providing a specially crafted value for the pppoeServiceName parameter, an attacker can inject arbitrary operating‑system commands into the router’s command‑line interpreter. This flaw classifies as command injection (CWE‑77) and OS command injection (CWE‑78). The injected commands are executed with the privileges of the web server process, allowing the attacker to read, modify, or delete data, or take full control of the router.

Any Totolink A7100RU router running firmware 7.4cu.2313 is affected. The exposure occurs through the publicly accessible /cgi-bin/cstecgi.cgi endpoint that accepts the pppoeServiceName argument. Devices with this firmware and remote management enabled or exposed to the Internet are at risk. Other firmware versions or routers from different vendors are not affected per the current data.

The flaw has a CVSS score of 9.3, indicating critical severity. No EPSS score is published and the vulnerability is not listed in the CISA KEV catalog, but a publicly available exploit has already been released, which elevates the likelihood of exploitation. Attackers can remotely trigger the injection by sending crafted HTTP requests to cstecgi.cgi, potentially compromising the entire device. The remote nature, high severity, and available exploit make this vulnerability highly dangerous, especially for routers exposed directly to the Internet.