What is the CVSS score of CVE-2026-31170?

CVE-2026-31170 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of ToToLink A3300R are affected by CVE-2026-31170?

ToToLink A3300R routers running firmware v17.0.0cu.557_B20221024 are vulnerable to unauthenticated remote command execution through the /cgi-bin/cstecgi.cgi endpoint, allowing attackers to gain…

How to fix or mitigate CVE-2026-31170?

Within 24 hours: Identify all ToToLink A3300R routers in production and document firmware versions via management interfaces or physical access; isolate any running v17.0.0cu.557_B20221024 from production networks if possible. Within 7 days: Contact ToToLink support to confirm availability of patched firmware versions beyond v17.0.0cu.557_B20221024 and obtain release timelines; implement network segmentation to restrict router administrative access to controlled jump hosts only. Within 30 days: Apply vendor-released firmware updates to all affected ToToLink A3300R units as patches become available; conduct network traffic analysis on isolated devices to detect prior exploitation indicators.

ToToLink A3300R CVE-2026-31170

EUVD-2026-21016 CRITICAL

Command Injection (CWE-77)

2026-04-09 mitre

GHSA-cmwm-73hq-3hhx

Command Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 16:52 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 17:25 vuln.today

CVSS changed

Apr 14, 2026 - 17:22 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 09, 2026 - 19:15 euvd

EUVD-2026-21016

CVE Published

Apr 09, 2026 - 00:00 nvd

N/A

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun-pass parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 enables unauthenticated remote attackers to execute arbitrary OS commands via the stun-pass parameter in /cgi-bin/cstecgi.cgi endpoint. No public exploit identified at time of analysis, despite GitHub vulnerability disclosure repository. CVSS 9.8 (Critical) reflects trivial network-based exploitation without authentication, though EPSS probability remains low (0.01%, 2nd percentile), suggesting limited current attacker interest in this specific router model despite maximum severity rating.

Technical ContextAI

This vulnerability exploits CWE-77 (Command Injection) in the CGI interface of ToToLink A3300R routers, specifically the Common Gateway Interface script 'cstecgi.cgi' that processes STUN (Session Traversal Utilities for NAT) configuration parameters. The stun-pass parameter fails to properly sanitize user input before passing it to system shell commands, allowing injection of shell metacharacters or command separators. CGI scripts in embedded router firmware often directly invoke system() or popen() calls with inadequately validated parameters, particularly in legacy networking configuration interfaces. The affected endpoint handles network traversal settings, typically accessed during router administration. The A3300R is a consumer-grade wireless router, and firmware version v17.0.0cu.557_B20221024 indicates a 2022 build that remains vulnerable as of this disclosure.

RemediationAI

No vendor-released patch identified at time of analysis. ToToLink has not published firmware updates or security advisories addressing CVE-2026-31170 according to available references. Organizations using ToToLink A3300R routers should implement immediate network-level mitigations: restrict administrative interface access to trusted management VLANs only, disable remote administration features entirely if not required, implement strict IP allowlisting for CGI endpoint access if administrative access is necessary, and deploy web application firewall rules to block special characters in stun-pass parameter values. Long-term remediation requires replacing affected hardware with actively-supported router models from vendors with established security update programs, as ToToLink's patch cadence for consumer products appears inconsistent. Monitor the vendor disclosure repository at https://github.com/Svigo-o/TOTOLINK-Vul for potential community-developed firmware patches, though applying unofficial firmware carries additional risk.