The vulnerability is caused by missing input validation in the ping_size parameter and can be exploited to inject and execute arbitrary shell commands. It is possible to start a telnetd or upload and execute a backdoor to compromise the device.
Injecting scripts into the parameter wait_time reveals that this parameter is not properly validated for malicious input.
Injecting URLs into the parameter submit_button reveals that this parameter is not properly validated for malicious input.