TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter.
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')