The vulnerability exists in the setWanCfg command of the /cgi-bin/cstecgi.cgi script on the Totolink NR1800X router. By manipulating the Hostname argument in a POST request, an attacker can inject arbitrary commands, enabling remote code execution. This flaw is a classic command injection described by CWE‑74 and CWE‑77 and allows a threat actor to gain full control over the device's operating system.

The flaw affects Totolink NR1800X routers running firmware 9.1.0u.6279_B20210910. No other firmware versions or product variants are listed as affected.

The CVSS score of 5.3 indicates moderate severity, but the EPSS score below 1% suggests a very low likelihood of widespread exploitation at this time. The vulnerability is not yet listed in the CISA KEV catalog, though it has been publicly demonstrated. Attackers can exploit this remotely by sending a crafted POST request to /cgi-bin/cstecgi.cgi; it is inferred that the attacker can do this from an external network that has reachability to the router's management interface. In the absence of mitigations, successful injection would grant full administrative access to the device's shell.