A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component C…

A critical OS command injection vulnerability has been identified in Totolink A7100RU router firmware version 7.4cu.2313_b20191024. The vulnerability affects the setIptvCfg function in the CGI handler component, specifically through manipulation of the igmpVer parameter in the /cgi-bin/cstecgi.cgi file. The vulnerability can be exploited remotely, allowing attackers to execute arbitrary OS commands on the affected device. Public exploits are available, significantly increasing the risk of active exploitation. This represents a high-severity security weakness in IoT network infrastructure that could lead to complete device compromise.