What is the CVSS score of CVE-2026-31181?

CVE-2026-31181 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of TOTOLINK A3300R are affected by CVE-2026-31181?

TOTOLINK A3300R routers (firmware v17.0.0cu.557_B20221024) contain an unauthenticated remote code execution vulnerability allowing attackers to inject arbitrary OS commands via the stunServerAddr…

How to fix or mitigate CVE-2026-31181?

Within 24 hours: Inventory all TOTOLINK A3300R routers and confirm firmware version; immediately block unauthenticated access to /cgi-bin/cstecgi.cgi via firewall rules restricting the web interface to trusted administrator networks only. Within 7 days: Implement network segmentation to isolate affected routers from systems handling sensitive data; deploy IDS/IPS signatures to detect exploitation attempts targeting the stunServerAddr parameter; enable detailed logging on affected devices. Within 30 days: Contact TOTOLINK support to confirm if firmware v17.0.1 or later contains a fix; initiate replacement procurement and begin migration to patched firmware or alternative router models; document all compensating controls for audit purposes.

TOTOLINK A3300R CVE-2026-31181

EUVD-2026-25248 CRITICAL

OS Command Injection (CWE-78)

2026-04-23 mitre

GHSA-gr6m-gpr8-xrmv

Command Injection N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated OS command injection over the network with no user interaction yields PR:N/UI:N/AC:L; root-level command execution gives full C:H/I:H/A:H, though real AV may be adjacent if WAN mgmt is off.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 19:27 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 19:27 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 23, 2026 - 17:30 euvd

EUVD-2026-25248

Analysis Generated

Apr 23, 2026 - 17:30 vuln.today

CVE Published

Apr 23, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

OS command injection in TOTOLINK A3300R routers (firmware v17.0.0cu.557_B20221024) lets remote attackers run arbitrary commands by injecting shell metacharacters into the stunServerAddr parameter of the /cgi-bin/cstecgi.cgi endpoint. The flaw carries CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists, though EPSS remains low at 0.06% and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the cstecgi.cgi CGI handler that powers the web management interface of TOTOLINK's A3300R SOHO router. This handler processes user-supplied parameters and passes the stunServerAddr value (used to configure a STUN server address for NAT traversal) into an underlying shell/system call without sanitization, matching CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Command injection in these MIPS-based embedded busybox environments typically executes as root, since router web daemons run with full privileges. The CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not identify the product, so affected-product identification relies on the description rather than structured NVD CPE data.

RemediationAI

No vendor-released patch identified at time of analysis; no fixed firmware version is cited in the available data, so a version-specific upgrade cannot be recommended. As compensating controls: disable remote/WAN-side web management so /cgi-bin/cstecgi.cgi is unreachable from the internet (side effect: administration only possible from the LAN), and restrict LAN access to the admin interface via firewall/ACLs or a management VLAN to limit which hosts can reach the CGI endpoint. Where the STUN/NAT-traversal feature configured via stunServerAddr is not required, avoid changing that setting and consider disabling the feature to reduce the reachable attack surface. Monitor TOTOLINK's support site for updated A3300R firmware and apply it once released; given the vendor's history, consider replacing end-of-support hardware if no fix is published. Track the researcher advisory at https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-server-addr-cmd-injection.