TOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDevice function.

A command injection vulnerability was discovered in TOTOLINK N200RE V5 router firmware. The vulnerability exists in the formMapDelDevice function and can be exploited through the macstr and bandstr parameters. This security flaw allows attackers to execute arbitrary commands on the affected device. The vulnerability has been assigned CVE-2026-36841 and affects the router's web interface functionality. Proof-of-concept code has been made available on GitHub demonstrating the exploitation technique.