TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd function.
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')