This vulnerability affects the Totolink CA750-PoE device running firmware 6.2c.510. The issue is an OS command injection in the setPasswordCfg function of the /cgi-bin/cstecgi.cgi component, triggered by manipulation of the admuser and admpass arguments. The attack vector is remote network access with low privileges and no user interaction required. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the potential for remote command execution with limited privileges and low complexity. No official patch or vendor advisory is currently available, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows an attacker to execute arbitrary operating system commands remotely on the affected device with low privileges. This could lead to unauthorized control or disruption of the device. However, the impact is somewhat limited by the requirement for low privilege access and the lack of user interaction. There are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor vendor communications for updates. As a precaution, restrict network access to the device's management interface to trusted hosts only and consider disabling remote management if not required. Avoid exposing the device management interface directly to untrusted networks until a fix is released.