The vulnerability in the TOTOLINK N200RE V5 firmware exposes a command injection flaw through the macstr and bandstr parameters of the formMapDelDevice function. An attacker who can supply values to these parameters could execute arbitrary operating‑system commands on the device, potentially compromising the router’s confidentiality, integrity, and availability. The described weakness corresponds to the classic command injection category (CWE‑78).

Devices running the TOTOLINK N200RE V5 firmware, particularly those exposing the formMapDelDevice interface. No additional version constraints are provided beyond the V5 designation.

The CVE has a CVSS score of 9.8, indicating a critical severity. It is not listed in the CISA KEV catalog and no EPSS score is available, suggesting limited publicly known exploitation. However, the lack of a vendor‑issued fix combined with the severity of a remote command injection implies a high risk to network‑connected routers if the vulnerable interface remains accessible. Attackers would need network reachability to the device’s management interface; the exploit would succeed with no special authentication prerequisites as implied by the exposed parameters.