The vulnerability resides in the setWebWlanIdx parameter of the /cgi-bin/cstecgi.cgi script that runs as part of the router's web management interface. Manipulating this argument allows an attacker to inject arbitrary operating‑system commands, which the device executes with elevated privileges. The flaw is a classic command injection and can be triggered exclusively through the network; a remote attacker simply needs to send a specially crafted HTTP request to exploit it. The impact is a full compromise of the device, giving the attacker the ability to run any command, modify firmware, or use the router as a launchpad for further attacks. This flaw exploits OS command injection weaknesses, identified as CWE‑77 and CWE‑78.

All Totolink N300RH routers running firmware version 6.1c.1353_B20190305 are affected. This model is commonly sold as a consumer‑grade wireless access point and router in home and small office environments. Earlier firmware revisions may also contain the flaw, but the vulnerability is explicitly documented for this revision.

The CVSS base score for this vulnerability is 9.3, indicating critical severity. The EPSS score of 1% shows that the probability of exploitation in the wild is low but not negligible, especially since public exploits have already been released. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, yet the demonstrated remote attack vector and lack of legitimate mitigation paths mean it remains highly relevant to all affected deployments. Attacks can be launched from any network segment that can reach the router's management interface.