What is the CVSS score of CVE-2026-31166?

CVE-2026-31166 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ToToLink A3300R CVE-2026-31166

EUVD-2026-25256 MEDIUM

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-rf7j-q56m-3624

Command Injection N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.8 CRITICAL

Arbitrary command execution on embedded Linux firmware typically yields full C/I/A impact; the provided C:L/I:L/A:N is inconsistent with that capability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:53 vuln.today

CVSS changed

Apr 23, 2026 - 20:26 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 19:00 euvd

EUVD-2026-25256

CVE Published

Apr 23, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the hour parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows network-accessible attackers to execute arbitrary OS commands by supplying shell metacharacters in the 'hour' parameter of the /cgi-bin/cstecgi.cgi management endpoint. A public proof-of-concept is confirmed on GitHub and SSVC classifies exploitation as automatable, meaning scripted mass-scanning is feasible against any exposed management interface. No vendor-released patch has been identified; the provided CVSS impact scoring of C:L/I:L/A:N appears inconsistent with the actual capability of arbitrary command execution on embedded firmware, warranting independent re-evaluation.

Technical ContextAI

The ToToLink A3300R is a consumer-grade wireless router running an embedded Linux-based firmware (v17.0.0cu.557_B20221024). Its web management interface is served via CGI through /cgi-bin/cstecgi.cgi, a common pattern in budget MIPS/ARM embedded devices where a single CGI binary dispatches all management actions. The 'hour' parameter - likely part of a time-scheduling or cron-related feature - is passed unsanitized to a system-level call, constituting a CWE-77 (Improper Neutralization of Special Elements used in a Command) flaw. CWE-77 encompasses OS command injection where user-supplied input is inserted into a shell command string without adequate escaping or allowlisting. CPE data in the NVD record is undefined (cpe:2.3:a:n/a:n/a), indicating the vendor has not yet been formally registered in the NVD product dictionary, but the description and GitHub PoC reference unambiguously identify the affected device and firmware build.

RemediationAI

No vendor-released patch has been identified at time of analysis - ToToLink has not published a firmware update or security advisory addressing this issue. As a primary compensating control, restrict network access to the A3300R management interface (port 80/443) to trusted hosts only using firewall ACLs or router-level access rules, accepting the trade-off of reduced remote manageability. If the device is internet-facing, immediately disable remote management and ensure it sits behind NAT without port forwarding to the management port. Consider replacing the device with a supported product if a vendor patch is not forthcoming, given the absence of CPE data suggesting limited NVD tracking. Monitor the GitHub PoC at https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-hour-cmd-injection for any updates on patch availability or additional exploitation details.