EUVD-2026-25243
GHSA-83gp-p6q8-6rr3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Arbitrary OS command execution on embedded Linux router firmware yields full confidentiality, integrity, and availability impact, not the C:L/I:L/A:N the submitted vector claims.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeServiceName parameter to /cgi-bin/cstecgi.cgi.
AnalysisAI
Command injection in TOTOLINK A3300R firmware v17.0.0cu.557_B20221024 allows unauthenticated remote attackers to execute arbitrary OS commands by supplying shell metacharacters in the pppoeServiceName parameter submitted to /cgi-bin/cstecgi.cgi. A public proof-of-concept repository exists (SSVC exploitation=poc; GitHub reference confirmed) and the attack is classified as automatable with no privileges or user interaction required per the CVSS vector. No vendor-released patch has been identified at time of analysis, and the provided CVSS impact metrics (C:L/I:L/A:N) appear significantly understated relative to what arbitrary OS command execution on an embedded router realistically yields.
Technical ContextAI
The vulnerability resides in the CGI-based web management interface of the TOTOLINK A3300R, a SOHO broadband router. The cstecgi.cgi handler processes PPPoE (Point-to-Point Protocol over Ethernet) connection configuration, and the pppoeServiceName field is passed unsanitized into a dynamically constructed OS command - a textbook CWE-77 (Improper Neutralization of Special Elements used in a Command) flaw. The shell metacharacters in the attacker-controlled parameter are interpreted by the underlying OS command interpreter rather than treated as data. TOTOLINK routers are well-documented as running CGI processes with elevated privileges on embedded Linux, meaning injected commands typically execute with root-level access. The NVD CPE entry (cpe:2.3:a:n/a:n/a) is a placeholder and has not been formally assigned, indicating the vulnerability has not yet been fully processed into the national database. The ENISA EUVD tracks this as EUVD-2026-25243. The specific firmware string v17.0.0cu.557_B20221024 identifies the exact vulnerable build.
RemediationAI
No vendor-released patch has been identified at time of analysis - no TOTOLINK advisory or updated firmware has been linked in the available references. Administrators should first check https://www.totolink.net for firmware updates beyond v17.0.0cu.557_B20221024. As an immediate compensating control, disable remote (WAN-side) management access to the router's web interface, which eliminates internet-facing exposure and limits the attack surface to LAN-resident adversaries. If the router management interface can be restricted to a specific management VLAN or IP range via ACL, apply that restriction. As a secondary control, disable PPPoE service name configuration in the admin panel if the feature is not in use, though this may not fully neutralize the injection path depending on whether the parameter is processed regardless of functional use. Replacing the device with a model that has active vendor security support should be evaluated given the absence of a patch and TOTOLINK's historical patch cadence for this product line.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today