This vulnerability exists in the Totolink CA750-PoE device firmware 6.2c.510, specifically in the setWebWlanIdx function of the /cgi-bin/cstecgi.cgi handler. By manipulating the webWlanIdx parameter, an attacker can perform OS command injection remotely without user interaction or privileges beyond what the service allows. The CVSS 4.0 score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, and partial impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to unauthorized control or disruption of the device. The impact is rated medium due to partial confidentiality, integrity, and availability impacts and the lack of required privileges or user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the device's management interface from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.