What is the CVSS score of CVE-2026-31175?

CVE-2026-31175 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of TOTOLINK A3300R are affected by CVE-2026-31175?

TOTOLIK A3300R routers (firmware v17.0.0cu.557_B20221024) contain a critical unauthenticated remote code execution vulnerability; publicly available exploit code exists.

How to fix or mitigate CVE-2026-31175?

Within 24 hours, identify and inventory all TOTOLIK A3300R routers in your environment with current firmware versions. Within 7 days, isolate internet-facing or untrusted-network-facing instances through network segmentation, firewall rules, or offline deployment; contact TOTOLIK support for patch timeline confirmation. Within 30 days, establish monitoring for vendor patch releases and evaluate alternative router solutions if no patch roadmap is committed; test any patches in air-gapped environments before production deployment.

TOTOLINK A3300R CVE-2026-31175

EUVD-2026-25264 CRITICAL

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-7442-hxj8-4fvg

Command Injection N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated command injection over HTTP with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding root-level command execution gives total C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:53 vuln.today

CVSS changed

Apr 23, 2026 - 19:27 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 23, 2026 - 18:15 euvd

EUVD-2026-25264

CVE Published

Apr 23, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunEnable parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Command injection in the TOTOLINK A3300R router (firmware v17.0.0cu.557_B20221024) lets remote attackers execute arbitrary OS commands by injecting into the stunEnable parameter of the /cgi-bin/cstecgi.cgi endpoint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with total confidentiality, integrity, and availability impact, and publicly available exploit code exists via a GitHub PoC. Despite the 9.8 rating, EPSS is only 0.06% (19th percentile), and there is no CISA KEV listing, so no active exploitation is confirmed.

Technical ContextAI

The affected component is the cstecgi.cgi CGI binary that backs the web management interface of TOTOLINK SOHO routers, a common pattern in low-cost MediaTek/Realtek-based consumer gateways where CGI handlers pass user-supplied parameters into shell or system calls without sanitization. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning the stunEnable parameter value is incorporated into a command string and metacharacters (e.g. ;, &, |, backticks) are not neutralized, allowing shell command injection. The CPE data is unhelpful here (cpe:2.3:a:n/a:n/a:*), so exact affected-product identification relies on the description naming the A3300R and the specific firmware build.

RemediationAI

No vendor-released patch identified at time of analysis; TOTOLINK has not published a fixed firmware version in the provided data, so monitor the vendor's firmware download page for an update superseding v17.0.0cu.557_B20221024 and apply it once released. As compensating controls, disable remote/WAN web management so /cgi-bin/cstecgi.cgi is not reachable from the internet (trade-off: administrators must be on the LAN or VPN to manage the device), restrict access to the management interface to trusted management hosts via firewall/ACLs, and place the device behind an upstream firewall that blocks inbound access to the HTTP management port (side effect: none for normal LAN clients). Where feasible, consider replacing end-of-support consumer hardware, since these devices frequently receive delayed or no security fixes. Reference the PoC and advisory at https://github.com/Svigo-o/TOTOLINK-Vul and https://nvd.nist.gov/vuln/detail/CVE-2026-31175 to build detection and firewall rules.