The flaw occurs in the setNoticeCfg endpoint of /cgi-bin/cstecgi.cgi. An attacker can supply a malicious NoticeUrl value that the router forwards directly to the underlying shell, enabling arbitrary command execution. This command injection can compromise the router’s operating system and allow an attacker to take full control, potentially exposing the network it manages.

The vulnerability is confirmed on Totolink A3600R routers running firmware 4.1.2cu.5182_B20201102. The known affected product is the A3600R model. While the advisory does not list other versions, it is inferred from the description that any firmware build that still uses the unvalidated NoticeUrl parameter in the setNoticeCfg function could be susceptible.

The CVSS base score of 5.3 suggests moderate severity, while the EPSS score of 4% indicates low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. It is inferred that a remote attacker could craft a malicious HTTP request to the setNoticeCfg endpoint, though the CVE description does not explicitly state whether authentication or local privileges are required.