This vulnerability affects Totolink CA750-PoE firmware version 6.2c.510 and involves an OS command injection in the NTPSyncWithHost function of the /cgi-bin/cstecgi.cgi component. By manipulating the host_time argument, an attacker can execute arbitrary OS commands remotely without requiring user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction needed, and low to limited impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with an available exploit but lacks an official patch or vendor remediation at this time.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to unauthorized control or disruption of the device. The medium severity score reflects moderate risk due to the ease of remote exploitation and potential impact on device integrity and availability. No known active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device, restricting access to the management interface, and monitoring for unusual activity. Avoid using the vulnerable firmware version 6.2c.510 where possible. No official or temporary fixes have been documented by the vendor at this time.