The vulnerability lies in the setPasswordCfg function of the /cgi-bin/cstecgi.cgi CGI handler used by the Totolink A7100RU router. An attacker can manipulate the admpass argument to inject operating‑system commands, which the router then executes. Successful exploitation gives the attacker full control over the device, enabling arbitrary code execution, data exfiltration, or disruptive operations that could compromise confidentiality, integrity, and availability.

Affected devices are Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. The flaw is present in the setPasswordCfg CGI script accessed remotely, so any router with this firmware is vulnerable.

The CVSS score of 9.3 classifies the issue as critical, and the exploit has been disclosed publicly with remote execution possible without specialized privileges. While an EPSS value is not provided, the lack of a KEV listing does not diminish the risk; attackers can leverage the flaw from any network that can reach the router’s management interface. As the attack vector is remote, the potential damage spans the entire device.