The vulnerability resides in the SetUnloadUserData function found in the /cgi-bin/cstecgi.cgi script of the CA750‑PoE router. By manipulating the HTTP request parameter plugin_version, an external attacker may inject arbitrary operating‑system commands. This enables remote execution of commands on the device, potentially granting full control over the router's operating system and any connected network traffic. The weakness is classified as OS Command Injection (CWE‑77 and CWE‑78).

The affected device is the Totolink CA750‑PoE router running firmware version 6.2c.510. No other product or version information is disclosed in the advisory.

The CVSS base score is 5.3, indicating moderate severity. The EPSS score is 5%, and the vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely by sending a crafted HTTP request to the infected endpoint; the exploit is publicly available and has already been demonstrated in the wild. Given the remote nature and the ability to run arbitrary commands, the potential impact on confidentiality, integrity, and availability is significant for any individual who can reach the device over the network.