This vulnerability in Totolink NR1800X firmware 9.1.0u.6279_B20210910 allows remote attackers to perform command injection via the setUssd parameter in the sub_41A68C function of the /cgi-bin/cstecgi.cgi endpoint. The flaw enables execution of arbitrary commands on the device without user interaction or privileges beyond those required to access the vulnerable CGI script. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed with exploit code available, but no vendor patch or official remediation has been documented.

Successful exploitation can lead to arbitrary command execution on the affected Totolink NR1800X device remotely. This may allow attackers to take control of the device, disrupt network operations, or use the device as a foothold for further attacks. The high CVSS score reflects the critical nature of this vulnerability due to its remote exploitability and potential impact on device integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management interfaces if possible and restrict network access to the device's management functions. Monitor vendor channels for updates and apply patches promptly once available.