The vulnerability lies in the setNetworkDiag function exposed by the /cgi-bin/cstecgi.cgi script in Totolink CA750-PoE firmware 6.2c.510. Parameters such as NetDiagHost, NetDiagPingNum, NetDiagPingSize, NetDiagPingTimeOut, and NetDiagTracertHop are concatenated into operating‑system commands without validation, enabling an attacker to inject arbitrary shell commands via a crafted HTTP request. This flaw is a classic OS command injection (CWE‑77) and path‑injection style weakness (CWE‑78) that permits remote execution of commands on the device, potentially leading to full system compromise, data exfiltration, or service disruption. The description states that the attack can be initiated remotely and that the exploit has been publicly disclosed.

The affected product is the Totolink CA750-PoE router, firmware 6.2c.510. No other vendors or product versions are listed as impacted in the CNA data. If the vendor offers newer releases, they should be examined for the presence of the same interface or a corrected implementation.

The CVSS score of 5.3 indicates moderate severity, but the nature of the flaw—remote command injection—raises the real‑world risk. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified; however, the flaw is publicly disclosed and not listed in the CISA KEV catalog, suggesting it may not yet be actively exploited in the wild. The attack vector is remote, and the attacker can trigger the vulnerability by sending a crafted HTTP request to the cstecgi.cgi endpoint. Successful exploitation grants the attacker full command‑line control over the router.