The vulnerability resides in the function sub_41A68C of the /cgi-bin/cstecgi.cgi script in Totolink NR1800X firmware 9.1.0u.6279_B20210910. Altering the setUssd argument allows an attacker to inject arbitrary operating‑system commands, effectively achieving remote code execution on the router. The flaw permits attackers to compromise the device’s integrity and confidentiality by executing commands with the privileges of the daemon that runs the CGI script, potentially leading to full device takeover.

Affected systems are Totolink NR1800X routers running firmware version 9.1.0u.6279_B20210910. No other firmware releases or products are listed as impacted in the CNA data.

The CVSS score of 8.7 demonstrates a high severity for this issue. The EPSS score of 1% indicates a low but non‑zero likelihood of exploitation, and the flaw is publicly disclosed and can be exploited remotely via HTTP requests to the web interface, indicating a realistic attack vector for attackers with network access to the router. The vulnerability is not yet listed in the CISA KEV catalog, but its public exploit code raises concern for widespread potential exploitation.