What is the CVSS score of CVE-2026-31159?

CVE-2026-31159 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ToToLink A3300R CVE-2026-31159

EUVD-2026-25239 MEDIUM

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-m773-2ww5-wpvx

Command Injection N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.8 CRITICAL

Unauthenticated network-accessible command injection on router firmware realistically yields full OS control, warranting C:H/I:H/A:H over the NVD-assigned C:L/I:L/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 18:42 NVD

6.5 (None) 6.5 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 17:30 euvd

EUVD-2026-25239

Analysis Generated

Apr 23, 2026 - 17:30 vuln.today

CVE Published

Apr 23, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the password parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Unauthenticated command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 exposes the device's CGI management interface to arbitrary OS command execution via the password parameter at /cgi-bin/cstecgi.cgi. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms exploitation requires no credentials and no user interaction, making it scriptable against any Internet-exposed device. A public proof-of-concept exists on GitHub, and SSVC classifies the vulnerability as automatable with a PoC - though the EPSS score of 0.04% (12th percentile) suggests exploitation has not yet reached widespread real-world activity, likely reflecting the niche deployment footprint of this SOHO router model.

Technical ContextAI

The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements Used in a Command), the root cause class for command injection where attacker-controlled input is concatenated into an OS-level command string without sanitization. The affected component is /cgi-bin/cstecgi.cgi, a CGI binary embedded in the ToToLink A3300R firmware that processes web management requests. The password parameter - almost certainly part of the device's login or configuration handler - is passed unsanitized to a shell invocation, allowing shell metacharacters (e.g., semicolons, pipes, backticks) to break out of the intended command context. The CPE data provided is listed as n/a, which limits authoritative product enumeration, but the firmware version v17.0.0cu.557_B20221024 is explicitly named in the CVE description.

RemediationAI

No vendor-released patch has been identified at time of analysis for ToToLink A3300R firmware v17.0.0cu.557_B20221024. As an immediate compensating control, disable remote (WAN-side) web management on the device to prevent Internet-exposed exploitation - this eliminates the attack surface for external attackers, though it does not protect against LAN-side threats. Where feasible, place the router's management interface behind an ACL or restrict access to specific trusted IP addresses. Consider replacing the device with a supported model if ToToLink does not release a patched firmware, as embedded device vendors for SOHO equipment frequently abandon older hardware. Monitor the vendor site and the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-31159 for patch availability. Disabling the CGI management interface entirely, if operationally viable, removes the vulnerable endpoint at the cost of losing web-based device administration.