A3300R EUVD-2026-17279

This vulnerability presents HIGH real-world risk despite a 7.3 CVSS score. Multiple converging risk signals elevate priority: the CVSS vector confirms unauthenticated remote exploitation (PR:N) with low attack complexity (AC:L), meaning any network-adjacent attacker can exploit this without credentials. Public exploit code exists on GitHub (https://github.com/LvHongW/Vuln-of-totolink_A3300R), providing attackers with ready-to-use weaponization. While not currently listed in CISA KEV (no confirmed active exploitation at time of analysis), the combination of publicly available exploit code, pre-authentication RCE capability, and targeting of consumer routers creates significant exploitation potential. Consumer routers are high-value targets for botnet recruitment, persistence establishment, and network pivot operations. The attack is automatable given the straightforward exploitation methodology. SSVC decision factors indicate elevated priority: exploitation status is POC public, technical impact is total system compromise (command injection equals root access on embedded devices), and the vulnerable population includes potentially thousands of unpatched consumer routers with limited security monitoring. Organizations should treat this as a priority patch candidate despite moderate CVSS score.

An unauthenticated attacker on the internet identifies a Totolink A3300R router exposed on its WAN interface using automated scanning tools like Shodan or Censys. Using the public GitHub exploit code, the attacker crafts a malicious HTTP request to /cgi-bin/cstecgi.cgi targeting the setSyslogCfg function, injecting shell commands through improperly sanitized parameters (e.g., syslog server address field containing command separators). The router executes the injected commands with root privileges, allowing the attacker to establish persistent backdoor access, join the device to a botnet, exfiltrate network traffic, or pivot into the internal network behind the router. The low attack complexity and network-accessible attack vector enable mass exploitation campaigns against internet-facing devices.