What is the CVSS score of CVE-2026-31162?

CVE-2026-31162 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ToToLink A3300R CVE-2026-31162

EUVD-2026-25254 MEDIUM

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-482m-5v3m-rgpv

Command Injection N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.8 CRITICAL

Unauthenticated network-accessible OS command injection on embedded router firmware realistically yields root-level control, warranting C:H/I:H/A:H rather than the NVD-assigned partial impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:54 vuln.today

CVSS changed

Apr 23, 2026 - 19:27 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 19:00 euvd

EUVD-2026-25254

CVE Published

Apr 23, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the ttlWay parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Remote command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows unauthenticated network-adjacent or remote attackers to execute arbitrary OS commands by submitting shell metacharacters in the ttlWay parameter to the /cgi-bin/cstecgi.cgi management endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction exploitation with no authentication requirement, and SSVC classifies the attack as automatable. A public proof-of-concept is available on GitHub; however, EPSS at 0.04% (12th percentile) indicates limited observed exploitation in the wild at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected component is /cgi-bin/cstecgi.cgi, a CGI-based web management interface in ToToLink A3300R router firmware version v17.0.0cu.557_B20221024. CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies the root cause: the ttlWay HTTP parameter is passed unsanitized to an underlying shell command, enabling injection of arbitrary OS instructions via characters such as semicolons, pipes, or backticks. This class of flaw is endemic to embedded router firmware where CGI handlers directly interpolate HTTP input into system calls without escaping or allowlist validation. The CPE entry (cpe:2.3:a:n/a:n/a:*) provided by NVD is uninformative and does not narrow the scope beyond the firmware version named in the CVE description.

RemediationAI

No vendor-released patch has been identified at time of analysis - no patched firmware version is confirmed from any reference. Operators running ToToLink A3300R firmware v17.0.0cu.557_B20221024 should immediately restrict access to the web management interface: apply firewall rules to block all WAN-side access to the CGI endpoint (/cgi-bin/cstecgi.cgi) and limit LAN-side access to explicitly trusted management hosts. Disabling the remote administration feature entirely eliminates the externally reachable attack surface with no functional side effects for users who do not require remote management. Monitor for firmware updates on the ToToLink support portal. Detection controls should flag HTTP requests containing shell metacharacters (;, |, ` `, $()) in the ttlWay` parameter. The GitHub PoC at https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-ttl-way-cmd-injection can be used to verify exposure in a controlled test environment.