What is the CVSS score of CVE-2026-31174?

CVE-2026-31174 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ToToLink A3300R CVE-2026-31174

EUVD-2026-25263 MEDIUM

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-54xc-g42w-9wff

Command Injection N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.8 CRITICAL

Arbitrary OS command injection on embedded router firmware yields full device compromise; C:H/I:H/A:H corrects the provided C:L/I:L/A:N which understates actual impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:52 vuln.today

CVSS changed

Apr 23, 2026 - 19:27 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 18:15 euvd

EUVD-2026-25263

CVE Published

Apr 23, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the informEnable parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Unauthenticated remote command injection in ToToLink A3300R routers running firmware v17.0.0cu.557_B20221024 allows network-accessible attackers to execute arbitrary OS commands by injecting shell metacharacters into the informEnable parameter of the /cgi-bin/cstecgi.cgi CGI endpoint. A proof-of-concept exploit is publicly hosted on GitHub, and the SSVC assessment confirms the attack is automatable with no required privileges or user interaction. Despite the PoC availability, EPSS sits at 0.04% (12th percentile), suggesting limited observed exploitation at time of analysis, likely reflecting the niche deployment footprint of this device rather than limited attacker capability.

Technical ContextAI

The vulnerability is rooted in CWE-77 (Improper Neutralization of Special Elements used in a Command), where the CGI handler for /cgi-bin/cstecgi.cgi on the ToToLink A3300R fails to sanitize or validate the informEnable parameter before passing it to an underlying OS shell invocation. On embedded Linux-based router firmware - as is typical of TOTOLINK devices - CGI scripts commonly invoke system() or similar calls with user-supplied data, making command injection a recurring attack class across this product family. The affected firmware version is v17.0.0cu.557_B20221024. NVD CPE data (cpe:2.3:a:n/a:n/a) is uninformative; the specific affected product and firmware are confirmed solely by the CVE description and the third-party PoC repository. Other firmware versions have not been formally scoped.

RemediationAI

No vendor-released patch has been identified at time of analysis. Organizations should monitor the TOTOLINK vendor support portal for firmware updates addressing this issue and apply them immediately upon release. As compensating controls, restrict access to the device's web management interface by blocking HTTP/HTTPS inbound requests to /cgi-bin/cstecgi.cgi at the network perimeter or upstream firewall - this prevents remote exploitation but does not address LAN-side attackers. Disable WAN-side management access on the device if enabled, as this is the highest-risk exposure vector. If feasible, isolate the router's management interface to a dedicated out-of-band management VLAN with strict ACLs. If the device is at end-of-life and no vendor patch is forthcoming, replacement with a supported device is the recommended long-term action. The PoC repository is at https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-inform-enable-cmd-injection and the NVD entry is at https://nvd.nist.gov/vuln/detail/CVE-2026-31174.