This vulnerability affects Totolink CA750-PoE version 6.2c.510 and involves OS command injection through the setWebWlanIdx function in the /cgi-bin/cstecgi.cgi Setting Handler component. By manipulating the webWlanIdx parameter, an attacker can remotely execute arbitrary operating system commands on the device. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. Public exploits exist, but no official patch or remediation level has been provided by the vendor. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially compromising device integrity and control. The impact is rated as medium severity with limited confidentiality, integrity, and availability impact according to the CVSS 4.0 metrics. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been announced, users should monitor Totolink's advisories for updates. Until a patch is available, restricting network access to the device's management interface and disabling remote management features where possible may reduce exposure.