Icycu123

**Name of the Vulnerable Software and Affected Versions** Totolink X6000R AX3000 version 9.4.0cu.852 20230719 **Description** An issue exists in the shttpd component due to insufficient input validation. A remote attacker can exploit this by manipulating the `setWizardCfg()` function within the '/cgi-bin/cstecgi.cgi' endpoint, leading to command injection and the execution of arbitrary commands on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/cgi-bin/cstecgi.cgi' endpoint to minimize the risk of exploitation.