What is the CVSS score of CVE-2026-31177?

CVE-2026-31177 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of TOTOLINK A3300R are affected by CVE-2026-31177?

The TOTOLINK A3300R router (firmware v17.0.0cu.557_B20221024) contains a critical unauthenticated remote command injection vulnerability (CVSS 9.8) enabling attackers to execute arbitrary system…

How to fix or mitigate CVE-2026-31177?

Within 24 hours, complete an urgent network inventory identifying all TOTOLINK A3300R routers currently deployed, including firmware versions, management IP addresses, and network segmentation status. Within 7 days, implement layer-3 isolation by restricting management interface access to authorized administrative subnets only, disable WAN-accessible remote management services, and deploy intrusion detection signatures targeting POST requests to /cgi-bin/cstecgi.cgi with stunMinAlive parameters. Within 30 days, contact TOTOLINK for security patch timelines; if no patch is released within 60 days, initiate procurement for alternative router platforms and establish a replacement schedule for affected devices, prioritizing those with internet-facing management access.

TOTOLINK A3300R CVE-2026-31177

EUVD-2026-25245 CRITICAL

OS Command Injection (CWE-78)

2026-04-23 mitre

GHSA-cjmw-h9gc-q2ch

Command Injection N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Reachable command injection over the network at low complexity yielding root-level command execution gives full C/I/A; PR:N follows the recorded vector but is uncertain given TOTOLINK cstecgi.cgi flaws often need a session.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 19:27 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 19:27 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 23, 2026 - 17:30 euvd

EUVD-2026-25245

Analysis Generated

Apr 23, 2026 - 17:30 vuln.today

CVE Published

Apr 23, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

OS command injection in the TOTOLINK A3300R router (firmware v17.0.0cu.557_B20221024) lets remote attackers run arbitrary shell commands by injecting into the stunMinAlive parameter of the /cgi-bin/cstecgi.cgi endpoint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 Critical with no authentication qualifier indicated, and CISA's SSVC framework marks it automatable with total technical impact. Publicly available exploit code exists (researcher writeup on GitHub), though EPSS remains very low at 0.06% and it is not on the CISA KEV list - no public exploit indicates active exploitation yet.

Technical ContextAI

The A3300R is a consumer/SOHO wireless router whose web management interface is served by cstecgi.cgi, a common CGI handler across many TOTOLINK devices that dispatches configuration actions based on request parameters. This vulnerability is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning the stunMinAlive parameter value is passed into an underlying shell/system call without sanitization, so shell metacharacters (e.g. ;, |, `, $()) break out of the intended command context. The stunMinAlive field relates to STUN keep-alive timing configuration, and like numerous cstecgi.cgi parameters on TOTOLINK firmware it is concatenated into a system command executed with the router's high (typically root) privilege. CPE data is uninformative here (cpe:2.3:a:n/a:n/a:*), so the affected product identity rests on the description rather than a normalized NVD CPE.

RemediationAI

No vendor-released patch identified at time of analysis; TOTOLINK has not published a fixed firmware version in the available data, so monitor the TOTOLINK support/download portal for an A3300R firmware release superseding v17.0.0cu.557_B20221024 and apply it once issued. As compensating controls, disable remote/WAN-side access to the web administration interface so /cgi-bin/cstecgi.cgi is not reachable from the internet (trade-off: loses remote management convenience), and restrict LAN access to the admin panel to a trusted management host or VLAN. If the router supports it, place the device behind an upstream firewall that blocks inbound access to the HTTP/HTTPS management ports and drop unsolicited requests to /cgi-bin/cstecgi.cgi. Given this is EOL-class consumer hardware, the most robust mitigation is replacing the device with a currently-supported router. Consult the researcher writeup (https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-min-alive-cmd-injection) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-31177) for tracking.