CVE-2026-36841 is a command injection vulnerability in TOTOLINK N200RE V5 routers. The flaw exists in the formMapDelDevice function, specifically through the macstr and bandstr parameters, which can be manipulated to execute arbitrary system commands remotely without authentication. This vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS 3.1 base score is 9.8, reflecting critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and complete compromise of confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary commands on the device, potentially leading to full system compromise. This includes unauthorized access to sensitive data, modification or deletion of data, and disruption of device availability. Given the critical CVSS score and the nature of command injection, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device, especially from untrusted networks. Monitor for unusual activity related to the macstr and bandstr parameters. Avoid exposing the device management interface to the internet.