The vulnerability resides in the setIpQosRules function of the cstecgi.cgi CGI script on Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. An attacker can manipulate the Comment parameter to inject arbitrary operating‑system commands, resulting in remote code execution. This flaw corresponds to the OS Command Injection weaknesses identified as CWE‑77 and CWE‑78.

Affected devices are Totolink A7100RU routers supplied with the specified firmware build. No other vendors or product lines are mentioned in the advisory, and the issue is limited to the CGI handler component of the router firmware.

The CVSS base score of 9.3 reflects critical severity. The EPSS score is unavailable. The CISA KEV catalog does not list this entry, indicating no known exploitation at the time of disclosure. The likely attack vector is remote exposure of the CGI endpoint via the router's web interface or other network paths that allow HTTP requests. Successful exploitation would give an attacker administrative control over the router, compromising network traffic confidentiality, integrity, and availability.