This vulnerability affects the Totolink N300RH router running firmware version 6.1c.1353_B20190305. The issue is located in the setUpgradeUboot function of the upgrade.so component, where manipulation of the FileName argument leads to OS command injection. The vulnerability can be exploited remotely without requiring privileges or user interaction, potentially allowing attackers to execute arbitrary OS commands on the device. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No official fix or patch has been published, and the vendor has not provided remediation details. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to unauthorized control or disruption of the router. The vulnerability does not require authentication or user interaction, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability. There is no confirmed evidence of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting remote access to the device's management interfaces and monitor for unusual activity. Avoid exposing the device to untrusted networks. Follow updates from Totolink for any forthcoming patches or official mitigations.