TOTOLINK version 9.x suffers from a remote command injection vulnerability.