This vulnerability affects the Totolink A3600R router firmware version 4.1.2cu.5182_B20201102. The issue lies in the setNoticeCfg function of the /cgi-bin/cstecgi.cgi parameter handler, where the NoticeUrl argument can be manipulated to perform command injection. This allows an unauthenticated remote attacker to execute arbitrary commands on the device. The vulnerability is remotely exploitable without user interaction and has a medium severity rating (CVSS 5.3). Public exploit code exists, but there is no indication of active exploitation in the wild. No patch or official remediation guidance has been disclosed by the vendor.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption of the router. The impact is limited to devices running the specified vulnerable firmware version. There is no evidence of widespread exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting remote access to the device's management interface and monitor for unusual activity. Avoid exposing the router's administrative interface to untrusted networks. Follow vendor channels for updates regarding patches or mitigations.