What is the CVSS score of CVE-2026-31176?

CVE-2026-31176 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ToToLink A3300R CVE-2026-31176

EUVD-2026-25244 MEDIUM

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-3p3v-qhpw-qrgr

Command Injection N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.8 CRITICAL

Command injection yields full OS control on the router, warranting C:H/I:H/A:H; PR:N retained per available evidence that the endpoint lacks authentication.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 18:42 NVD

6.5 (None) 6.5 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 17:30 euvd

EUVD-2026-25244

Analysis Generated

Apr 23, 2026 - 17:30 vuln.today

CVE Published

Apr 23, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun-user parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 exposes the device to arbitrary OS command execution via the stun-user parameter of the /cgi-bin/cstecgi.cgi endpoint. The CVSS vector assigns no privileges required and no user interaction, making this remotely exploitable from the network, and the SSVC framework independently classifies it as automatable with a publicly available proof-of-concept on GitHub. Notably, the provided CVSS impact ratings of C:L/I:L/A:N appear to significantly understate the realistic consequence of arbitrary command execution on embedded router firmware - no public exploit activity is confirmed and EPSS sits at the 12th percentile, suggesting limited real-world exploitation so far.

Technical ContextAI

The vulnerable endpoint is /cgi-bin/cstecgi.cgi, the web-based management CGI handler present in ToToLink router firmware. The stun-user parameter corresponds to STUN (Session Traversal Utilities for NAT) user credential configuration - a feature enabling NAT traversal for VoIP or peer-to-peer traffic. The firmware fails to sanitize shell metacharacters (CWE-77: Improper Neutralization of Special Elements used in a Command) before passing the user-supplied value to an OS-level call, allowing injection of arbitrary shell commands. This vulnerability pattern is endemic to SOHO/consumer router firmware where configuration parameters are passed directly to system() or popen() calls without adequate validation. The affected firmware version is v17.0.0cu.557_B20221024 on the A3300R hardware platform. The CPE provided (cpe:2.3:a:n/a:n/a) is a placeholder and does not resolve to a specific NVD entry; affected scope is confirmed only from the researcher disclosure and NVD description.

RemediationAI

No vendor-released patch has been identified at time of analysis - no ToToLink security advisory was found among the provided references. As an immediate compensating control, administrators should disable remote (WAN-side) access to the router's web management interface, which prevents unauthenticated network exploitation of the CGI endpoint; note this does not protect against LAN-side attackers. If WAN management access is required operationally, restrict it to specific trusted IP addresses via firewall ACLs - this substantially reduces attack surface but depends on the router's own ACL implementation not being bypassed. Users should monitor the researcher's GitHub disclosure at https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-user-cmd-injection for updates. Given the lack of an upstream fix and the PoC availability, organizations managing TOTOLINK A3300R deployments at scale should consider device replacement with a supported model that receives security updates.