A CSRF issue in "/api/crontab" allows a threat actor to create a crontab entry in the router administration panel. The cronjob will execute the entry on the threat actor's defined interval, leading to remote code execution and filesystem access. If the router's default credentials are not rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction.