The attack vector involves manipulating the fwUrl or magicid parameters in the recvUpgradeNewFw function within the Setting Handler component. A remote attacker can trigger an OS command injection (CWE‑77) through malformed input, and the vulnerability also permits path traversal to execute arbitrary system commands (CWE‑78), allowing execution of arbitrary system commands on the device. This vulnerability compromises confidentiality, integrity, and availability of the affected router.

Affected systems include Totolink CA750-PoE models running firmware version 6.2c.510. No other versions or variants are listed; the recommended firmware upgrade would need to be verified.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of 0.05 (5%) suggests a low but non-zero probability of exploitation, and the vulnerability is not listed in CISA KEV, implying no known active exploitation. However, the public exploit is available, and the remote nature of the attack means any network connectivity to the device could allow exploitation.