What is the CVSS score of CVE-2026-31173?

CVE-2026-31173 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ToToLink A3300R CVE-2026-31173

EUVD-2026-25262 MEDIUM

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-r5xp-xr88-r2wf

Command Injection N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.8 CRITICAL

Arbitrary OS command execution on embedded firmware typically runs as root, warranting C:H/I:H/A:H; no authentication confirmed by PR:N in source vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:51 vuln.today

CVSS changed

Apr 23, 2026 - 19:27 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 19:00 euvd

EUVD-2026-25262

CVE Published

Apr 23, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the interval parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 allows unauthenticated remote attackers to execute arbitrary OS commands by supplying a crafted value to the interval parameter of the /cgi-bin/cstecgi.cgi endpoint. The SSVC assessment confirms publicly available proof-of-concept exploit code exists and the attack is automatable, meaning scripted mass exploitation is feasible against any internet-exposed instance. No KEV listing is present and EPSS sits at a low 0.04%, likely reflecting the niche market footprint of the device rather than low exploitability.

Technical ContextAI

The vulnerability resides in the CGI-based web management interface of the ToToLink A3300R, a SOHO broadband router. The /cgi-bin/cstecgi.cgi script accepts HTTP requests and processes the interval parameter without adequate sanitization before passing it to an underlying OS command - a textbook CWE-77 (Improper Neutralization of Special Elements Used in a Command) flaw. On embedded Linux-based firmware such as this, CGI handlers frequently execute with elevated privileges (root), meaning injected commands run in a high-privilege context. The CPE data provided is non-specific (n/a), so the exact affected binary or firmware component cannot be confirmed from NVD alone; the GitHub PoC repository at github.com/Svigo-o/TOTOLINK-Vul is the primary technical reference. The CVSS vector confirms network reachability (AV:N) with no authentication requirement (PR:N) and low attack complexity (AC:L).

RemediationAI

No vendor-released patch has been identified at time of analysis - ToToLink has not published a firmware update addressing this CVE in the available references. As an immediate compensating control, disable remote (WAN-side) access to the router's web management interface, which is often accessible via HTTP on port 80 or 8080; this is the most impactful single mitigation and prevents unauthenticated network exploitation entirely, with the trade-off of requiring local LAN access for administration. Additionally, apply strict firewall rules to block external access to /cgi-bin/cstecgi.cgi. If the management interface must remain accessible, place it behind a VPN or restrict access by source IP. Users should monitor the ToToLink support site and the GitHub PoC repository (github.com/Svigo-o/TOTOLINK-Vul) for any firmware update referencing this endpoint. VulDB advisory at vuldb.com/vuln/359193 should be checked for patch status updates.