TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection via the host_time parameter in the NTPSyncWithHost function.
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')