An attacker can exploit an input validation flaw in the NTPSyncWithHost feature of the /cgi-bin/cstecgi.cgi script, sending a crafted host_time argument that is directly executed as a command on the device. This results in the ability to run arbitrary shell commands, giving the attacker full control over the affected router. The weakness is related to command injection vulnerabilities.

The vulnerability affects the Totolink NR1800X router with firmware version 9.1.0u.6279_B20210910. Only this specific firmware build is known to be susceptible; newer or older revisions may not be impacted.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of 3% suggests a low to moderate likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, but it has been publicly disclosed and a working exploit exists, which means a remote attacker with network access to the Telnet service can trigger the injection. The attack requires enumeration of the Telnet interface and sending crafted requests to the cstecgi.cgi endpoint.