The vulnerability in the TOTOLINK N200RE V5 firmware lies in the formMapDelDevice function, where the macstr and bandstr parameters are used without proper validation. This flaw allows an attacker that can supply values to those parameters to inject arbitrary operating‑system commands into the router. The consequence is that the attacker could gain control over the device, modify its configuration, exfiltrate data, or render it unavailable, representing a severe compromise of confidentiality, integrity, and availability. The weakness conforms to CWE‑77, command injection.

Devices running the TOTOLINK N200RE V5 firmware that expose the formMapDelDevice management interface are affected. No further version limits are provided beyond the V5 designation.

The CVSS score of 9.8 marks this as a critical vulnerability. The EPSS score is less than 1%, indicating a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Because the exposed parameters appear to be accessible without any mention of authentication controls, the lack of an authentication requirement is inferred from the description; an attacker with network reachability to the router’s management interface could exploit this flaw, potentially executing arbitrary code on the device.