What is the CVSS score of CVE-2026-31169?

CVE-2026-31169 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ToToLink A3300R CVE-2026-31169

EUVD-2026-25259 MEDIUM

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-34rf-7q76-c7fw

Command Injection N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.8 CRITICAL

Arbitrary command injection on embedded Linux firmware realistically yields full root shell access, warranting C:H/I:H/A:H rather than the reported C:L/I:L/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:55 vuln.today

CVSS changed

Apr 23, 2026 - 19:27 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 19:00 euvd

EUVD-2026-25259

CVE Published

Apr 23, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the week parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Unauthenticated remote command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 allows attackers to execute arbitrary OS commands by passing a malicious payload through the week parameter of the /cgi-bin/cstecgi.cgi CGI endpoint. A public proof-of-concept is hosted on GitHub (confirmed by SSVC exploitation status: poc), and the attack is rated automatable by SSVC, meaning mass scanning and exploitation is feasible without manual intervention. Despite these conditions, EPSS sits at 0.04% (12th percentile), indicating minimal observed exploitation in the wild at time of analysis - likely reflecting the niche deployment footprint of this budget consumer router.

Technical ContextAI

The vulnerability resides in the CGI web management interface of ToToLink A3300R firmware (v17.0.0cu.557_B20221024), specifically the /cgi-bin/cstecgi.cgi handler, which appears to process scheduling or time-related configuration via the week parameter. CWE-77 (Improper Neutralization of Special Elements used in a Command) describes a root cause where user-supplied input is concatenated directly into a shell command without sanitization or escaping - a classic OS command injection pattern common in embedded Linux firmware. The CGI process likely invokes a shell utility or system() call with the unsanitized week value, allowing injection of arbitrary shell metacharacters. The CPE string provided (cpe:2.3:a:n/a:n/a) is uninformative, meaning NVD has not yet assigned a formal CPE identifier for this firmware component; the affected product and version are sourced directly from the CVE description.

RemediationAI

No vendor-released patch has been identified at time of analysis - no ToToLink advisory or updated firmware version is referenced in the available data. As an immediate compensating control, the router's web management interface should be restricted so that /cgi-bin/cstecgi.cgi is not reachable from untrusted networks: disable WAN-side remote management in the router's admin settings and ensure the admin interface is accessible only from a trusted LAN segment or VPN. If remote management is required, restrict access by source IP using ACLs or upstream firewall rules. Consider replacing the device if a vendor patch does not become available, as command injection in firmware-level CGI handlers is typically unreliable to mitigate without a code fix. Monitor vendor release notes at the ToToLink support site for updated firmware addressing this parameter.