What is the CVSS score of CVE-2026-31167?

CVE-2026-31167 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ToToLink A3300R CVE-2026-31167

EUVD-2026-25257 MEDIUM

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-j4w2-w4h6-3353

Command Injection N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.8 CRITICAL

Arbitrary command execution on root-privileged embedded firmware yields full system compromise; C:H/I:H/A:H is warranted, overriding the source's understated C:L/I:L/A:N rating.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:52 vuln.today

CVSS changed

Apr 23, 2026 - 19:27 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 19:00 euvd

EUVD-2026-25257

CVE Published

Apr 23, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the mode parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Unauthenticated command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 permits remote attackers to execute arbitrary OS commands by supplying a malicious payload in the mode parameter to the /cgi-bin/cstecgi.cgi CGI endpoint. A public proof-of-concept is available on GitHub, and SSVC classifies the attack as automatable with no authentication required per the provided CVSS vector, making mass exploitation feasible despite a low EPSS score of 0.04%. No vendor patch has been identified at time of analysis, leaving devices with internet-exposed management interfaces without a vendor-supplied fix.

Technical ContextAI

The vulnerability exists in the web management CGI handler (/cgi-bin/cstecgi.cgi) of ToToLink A3300R SOHO router firmware. CWE-77 (Improper Neutralization of Special Elements Used in a Command) identifies the root cause: the mode parameter is incorporated into an OS shell command without adequate sanitization or escaping, allowing an attacker to break out of the intended command context and inject arbitrary shell instructions. Embedded router firmware of this class typically runs a BusyBox Linux environment with the web server process executing as root, meaning command injection commonly yields full privileged OS access. The NVD CPE entry (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) is uninformative; version specificity is derived entirely from the CVE description text referencing firmware build v17.0.0cu.557_B20221024.

RemediationAI

No vendor-released patch has been identified at time of analysis; patch availability and fix version are unknown. As an immediate compensating control, restrict access to the router's web management interface to trusted LAN IP addresses only using firewall ACLs or ingress rules, which eliminates remote unauthenticated exploitation but leaves LAN-side attackers capable of exploitation. If the device has remote management or WAN-side admin access enabled, disable it immediately - this is the highest-priority action given the unauthenticated network vector. Where supported, deploying community firmware such as OpenWrt (if compatible with the A3300R hardware) removes the vulnerable codebase entirely but may void support and requires technical expertise. Monitor the ToToLink vendor firmware page for updates to firmware v17.0.0cu.557_B20221024. The proof-of-concept at https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-mode-cmd-injection can be used to verify exposure in authorized testing environments.