This vulnerability affects the Totolink CA750-PoE device firmware 6.2c.510. The issue is located in the setUpgradeUboot function of the /cgi-bin/cstecgi.cgi file, part of the Setting Handler component. By manipulating the FileName argument, an attacker can perform OS command injection remotely. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official remediation or patch has been disclosed by the vendor as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to unauthorized control or disruption of the device. The impact is rated medium with limited confidentiality, integrity, and availability impact according to the CVSS 4.0 metrics. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict network access to the device's management interface to trusted sources only and monitor for unusual activity. Avoid exposing the device's CGI interface to untrusted networks.