What is the CVSS score of CVE-2026-31164?

CVE-2026-31164 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ToToLink A3300R CVE-2026-31164

EUVD-2026-25242 MEDIUM

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-2p3r-9wcw-v845

Command Injection N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

10.0 CRITICAL

OS command injection on a router CGI yields root shell access, warranting C:H/I:H/A:H with S:C; PR:N adopted per provided vector pending PoC verification.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:52 vuln.today

CVSS changed

Apr 23, 2026 - 19:27 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 17:45 euvd

EUVD-2026-25242

CVE Published

Apr 23, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 enables remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the pppoeMtu parameter of the /cgi-bin/cstecgi.cgi web management endpoint. A public proof-of-concept is available on GitHub, and SSVC classifies this as automatable with poc-level exploitation status. No public exploit identified at time of analysis meets the KEV threshold; EPSS sits at just 0.04% (12th percentile), suggesting limited real-world exploitation activity despite POC availability.

Technical ContextAI

The vulnerability resides in the CGI-based web management interface of the TOTOLINK A3300R router, specifically the /cgi-bin/cstecgi.cgi script. The pppoeMtu parameter - used to configure the Maximum Transmission Unit for PPPoE WAN connections - is passed to an OS-level command without adequate sanitization or escaping, constituting a CWE-77 (Improper Neutralization of Special Elements used in a Command) flaw. Because CGI scripts on embedded routers typically run with elevated privileges (root or equivalent), successful injection yields full OS-level access to the device. The NVD CPE entry (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) provides no meaningful product-level specificity; the affected product is identified solely through the description and the researcher's GitHub PoC targeting firmware version v17.0.0cu.557_B20221024.

RemediationAI

No vendor-released patch has been identified for this firmware version at time of analysis; administrators should check the TOTOLINK official site for updated firmware beyond v17.0.0cu.557_B20221024. As an immediate compensating control, disable WAN-side remote management on the router to eliminate network exposure from the internet - this is the most impactful single mitigation, eliminating the broadest attack surface at the cost of losing remote admin capability. Restrict access to the router's HTTP/HTTPS management ports to trusted LAN subnets or management VLANs via firewall ACLs, preventing lateral-movement-based exploitation from untrusted LAN segments. Note that neither control addresses the underlying injection flaw; they reduce exposure rather than eliminate the vulnerability. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-31164 and https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-pppoe-mtu-cmd-injection.