TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')