What is the CVSS score of CVE-2026-31160?

CVE-2026-31160 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ToToLink A3300R CVE-2026-31160

EUVD-2026-25241 MEDIUM

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-m5m9-mf97-g3hf

Command Injection N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

10.0 CRITICAL

Arbitrary OS command injection on a router grants root-level control affecting downstream network users, warranting S:C and high CIA impacts.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:12 vuln.today

CVSS changed

Apr 23, 2026 - 19:27 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 17:45 euvd

EUVD-2026-25241

CVE Published

Apr 23, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 exposes the device to unauthenticated remote OS command execution through the web management CGI interface. The provider parameter passed to /cgi-bin/cstecgi.cgi is not sanitized before being used in a system command, allowing any network-reachable attacker to run arbitrary commands on the router. A proof-of-concept is publicly available on GitHub (confirmed by SSVC classification), and SSVC rates the attack as automatable with partial technical impact; EPSS at 0.04% (12th percentile) suggests exploitation remains limited in scale, likely reflecting the narrow deployment footprint of this budget SOHO router model.

Technical ContextAI

The ToToLink A3300R is a SOHO (small office/home office) router running an embedded Linux firmware. Its web management interface relies on CGI scripts, specifically /cgi-bin/cstecgi.cgi, to process HTTP requests. CWE-77 (Improper Neutralization of Special Elements used in a Command) describes the root cause: the provider parameter value is incorporated into an OS-level command call without stripping or escaping shell metacharacters, enabling injection of arbitrary commands. This pattern is endemic to budget embedded firmware where shell-based CGI handlers directly interpolate user-supplied input into system() or popen() calls. The affected firmware version is v17.0.0cu.557_B20221024. CPE data in the NVD record is listed as n/a, which limits automated product matching and tracking across vulnerability scanners.

RemediationAI

No vendor-released patch or advisory has been identified at time of analysis; ToToLink does not have a known public security advisory program for this device. As a primary compensating control, restrict access to the web management interface (/cgi-bin/cstecgi.cgi) to trusted LAN hosts only via firewall ACLs or router access control settings, and ensure remote management (WAN-side HTTP/HTTPS access) is disabled - this eliminates the network attack surface for unauthenticated exploitation. If the device supports it, disable the web management interface entirely and manage via CLI or alternative means. Network segmentation placing the router management plane on an isolated VLAN adds additional defense. Consider replacing the device if it is at end-of-life or if the vendor does not release a patch, as command injection in the management CGI is a systemic firmware risk. The proof-of-concept repository at https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-provider-cmd-injection can be used to confirm exploitability in your environment.