An unauthenticated command injection in the Wavlink WL-WN531P3 router API, exploitable from the internet via CSRF.