The TOTOLINK CP900L firmware version 4.1.5cu.798_B20221228 includes a hardcoded password vulnerability located in the /etc/shadow.sample file. This vulnerability enables attackers to authenticate as the root user without authorization. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. There is currently no vendor advisory or patch available, and no known exploits have been reported in the wild.

Successful exploitation allows an attacker to gain root access to the affected device, resulting in complete control over the system. This can lead to unauthorized configuration changes, data theft, service disruption, and further network compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device management interface and monitor for unauthorized access attempts.