EUVD-2026-17054
GHSA-83j7-f6w3-6wmp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) indicates a network-accessible vulnerability with low attack complexity requiring authenticated login, resulting in local impact (confidentiality, integrity, availability within the device context). The EPSS probability is not provided, but the presence of publicly available exploit code (E:P in CVSS evidence tag) and confirmed disclosure significantly elevates practical risk despite the medium CVSS score. From a SSVC perspective: exploitation status is confirmed (public POC exists), the attack is not automatable in the traditional sense (requires prior authentication), and technical impact is high (command execution on router). For organizations deploying Totolik A3300R routers, this represents a medium-to-high priority issue if default credentials are widely used or if the router is accessible to untrusted network segments. Comparative analysis shows the 6.3 CVSS understates risk slightly due to the authentication gate; however, widespread use of default passwords in home/SMB deployments makes this a practical vulnerability. |
| Exploit ScenarioDerived | An attacker obtains valid credentials for the Totolink A3300R router (via default credentials, credential reuse, or phishing) and accesses the web administration panel. The attacker then crafts an HTTP request to /cgi-bin/cstecgi.cgi with a malicious ip parameter injected with shell metacharacters (e.g., |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 30, 2026
Command injection in Totolink A3300R router firmware version 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via a crafted ip parameter in the setStaticRoute function of /cgi-bin/cstecgi.cgi. The vulnerability carries a CVSS score of 6.3 (medium severity) with public exploit code available, enabling potential compromise of router configuration and data integrity.
RemediationAI
Verify current firmware version and check Totolink's official support portal (https://www.totolink.net/) for available firmware updates to a version later than 17.0.0cu.557_b20221024. Immediate workarounds include: restricting administrative interface access via firewall rules to trusted networks only, changing default router credentials to strong unique passwords, disabling remote management features if not required, and isolating router administration to a separate management VLAN. Given the low bar for exploitation (weak credentials), credential hygiene is critical. If a patched firmware version becomes available from Totolink, apply it immediately via the router's web interface or management tools.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper input validation in the CGI script handler cstecgi.cgi, specifically in the setStaticRoute function which processes static routing configuration. The flaw is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating that user-supplied input from the ip parameter is not properly sanitized before being passed to command execution contexts. Totolink A3300R is a consumer-grade WiFi router; the affected CPE range encompasses multiple firmware versions of this device model. The web-based administration interface accessible via /cgi-bin/cstecgi.cgi is the attack surface, requiring the attacker to have authenticated access (PR:L per CVSS vector), suggesting the vulnerability exploits weak default credentials, session hijacking, or cross-site request forgery on already-authenticated sessions.
Know when A3300R gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_b20221024. Impacted is the function setStaticRoute of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument ip leads to command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A3300R Parameter Handling Flaws
View all 4Command injection in Totolink A3300R router firmware 17.0.0cu.557_b20221024 allows unauthenticated remote attackers to e
Command injection in Totolink A3300R firmware versions up to 17.0.0cu.557_b20221024 allows authenticated remote attacker
Command injection in Totolink A3300R firmware 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute ar
Command injection in Totolink A3300R 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary c
OS command injection in Totolink A3300R firmware version 17.0.0cu.557_B20221024 allows authenticated local attackers to
Exploit-DB