The flaw occurs in the setNoticeCfg endpoint of /cgi-bin/cstecgi.cgi. An attacker can supply a malicious NoticeUrl value that the router forwards directly to the underlying shell, enabling arbitrary command execution. This command injection can compromise the router’s operating system and allow an attacker to take full control, potentially exposing the network it manages.

The vulnerability is confirmed on Totolink A3600R routers running firmware 4.1.2cu.5182_B20201102. The known affected product is the A3600R model. While the advisory does not list other versions, it is inferred from the description that any firmware build that still uses the unvalidated NoticeUrl parameter in the setNoticeCfg function could be susceptible.

The CVSS base score of 5.3 indicates moderate severity; the EPSS score of 3% implies low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path involves a remote attacker sending a specially crafted HTTP request to the setNoticeCfg endpoint without needing authentication or local privilege. If successful, the attacker could execute arbitrary shell commands on the device.