What is the CVSS score of CVE-2026-31172?

CVE-2026-31172 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ToToLink A3300R CVE-2026-31172

EUVD-2026-25261 MEDIUM

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-2q5c-gp7g-vp6x

Command Injection N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.8 CRITICAL

Unauthenticated network-accessible OS command injection with no complexity barriers warrants C:H/I:H/A:H; the NVD's C:L/I:L/A:N is inconsistent with arbitrary command execution on router firmware.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:13 vuln.today

CVSS changed

Apr 23, 2026 - 19:27 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 18:15 euvd

EUVD-2026-25261

CVE Published

Apr 23, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the user parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows remote attackers to execute arbitrary OS commands by sending a crafted request to /cgi-bin/cstecgi.cgi with a malicious user parameter. A public proof-of-concept is available on GitHub, and SSVC confirms exploitation is automatable with partial technical impact. Despite a CVSS score of 6.5 with conservative impact metrics, the arbitrary command execution nature of CWE-77 on a network-exposed CGI endpoint is likely understated - no vendor patch has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the CGI-based web management interface of the ToToLink A3300R wireless router running firmware version v17.0.0cu.557_B20221024. The endpoint /cgi-bin/cstecgi.cgi fails to sanitize the user parameter before incorporating it into a shell command, a textbook instance of CWE-77 (Improper Neutralization of Special Elements Used in a Command). This class of flaw arises when user-controlled input is concatenated into a command string without escaping or allowlisting, enabling shell metacharacters (semicolons, backticks, pipe operators) to inject additional commands. The CPE mapping in NVD is listed as cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*, indicating incomplete vendor-product tracking. ENISA tracks this as EUVD-2026-25261. The SSVC designation of automatable:yes confirms that exploitation can be scripted without per-target manual interaction.

RemediationAI

No vendor-released patch has been identified at time of analysis. As an immediate compensating control, disable remote WAN-side access to the router's web management interface - this eliminates the network-remote attack surface while retaining LAN-only access, though it does not address LAN-side exploitation. Where firewall rules are configurable upstream of the device, block inbound HTTP and HTTPS traffic to the management port (typically 80/443) from untrusted networks. If LAN exposure is also a concern, restrict management interface access to a single trusted admin IP via the router's ACL settings if supported by the firmware. Given the absence of a vendor patch and the low likelihood of one given the product's apparent lifecycle, organizations in regulated environments or with critical network dependencies should evaluate replacing the device with actively maintained hardware. Monitor the researcher's GitHub repository at https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-user-cmd-injection and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-31172 for patch or advisory updates from the vendor.