What is the CVSS score of EUVD-2026-25246?

EUVD-2026-25246 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of TOTOLINK A3300R are affected by EUVD-2026-25246?

A critical remote command execution vulnerability (CVE-2026-31178) in TOTOLINK A3300R routers allows unauthenticated attackers to gain complete control of affected devices, exposing organizations to…

How to fix or mitigate EUVD-2026-25246?

Within 24 hours, conduct asset inventory to identify all TOTOLINK A3300R devices and their firmware versions, and segregate v17.0.0cu.557_B20221024 from production networks pending risk assessment. Within 7 days, implement emergency compensating controls: isolate affected routers to a dedicated management VLAN, restrict administrative access to hardened bastion hosts, and enable enhanced monitoring for configuration changes and stunMaxAlive parameter manipulation. Within 30 days, contact TOTOLINK for security advisories and firmware availability; evaluate firmware alternatives or replacement hardware; develop a device replacement timeline targeting 60-90 day migration off affected equipment.

TOTOLINK A3300R EUVD-2026-25246

| CVE-2026-31178 CRITICAL

OS Command Injection (CWE-78)

2026-04-23 mitre

GHSA-4w7w-qm22-5p9j

Command Injection N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

OS command injection via a web CGI yields total device compromise; PR:L reflects that cstecgi.cgi handlers typically need a session, an area where the source vector's PR:N is unverified.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 19:27 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 19:27 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 23, 2026 - 17:30 euvd

EUVD-2026-25246

Analysis Generated

Apr 23, 2026 - 17:30 vuln.today

CVE Published

Apr 23, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

OS command injection in the TOTOLINK A3300R router firmware (v17.0.0cu.557_B20221024) lets remote attackers run arbitrary system commands by injecting shell metacharacters into the stunMaxAlive parameter handled by the /cgi-bin/cstecgi.cgi endpoint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes unauthenticated network exploitation with total confidentiality, integrity, and availability impact, effectively granting full control of the device. Publicly available exploit code exists (GitHub PoC), though EPSS is very low (0.06%) and it is not listed in CISA KEV, so exploitation is proof-of-concept rather than confirmed in-the-wild.

Technical ContextAI

The A3300R is a consumer/SOHO wireless router whose web management interface is driven by the cstecgi.cgi CGI binary - a common request dispatcher across many TOTOLINK devices that maps JSON/form parameters to internal handler functions. This flaw is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the stunMaxAlive value, which nominally configures a STUN keep-alive interval, is passed into a shell command (typically via system()/popen() or a call to a busybox utility) without sanitization, so characters such as ; | ` $() break out of the intended command and execute attacker-supplied commands. Because embedded router CGIs typically run as root, injected commands inherit full privileges. The CPE in the feed is a placeholder (cpe:2.3:a:n/a:n/a:*), so exact affected-product enumeration must come from the description rather than structured CPE data.

RemediationAI

No vendor-released patch identified at time of analysis - no fixed firmware version is cited in the provided data, so monitor the TOTOLINK support site for a firmware update superseding v17.0.0cu.557_B20221024 and apply it once published. As compensating controls: ensure the router's web management interface (/cgi-bin/cstecgi.cgi) is never exposed to the WAN/internet - disable remote/WAN administration, which prevents external exploitation at the cost of losing off-LAN management; restrict LAN-side access to the management interface to a trusted admin host or VLAN/ACL, accepting the inconvenience of managing from only that host; change default credentials and place the device behind a separate firewall segment; and if the STUN/keep-alive feature is not needed, disable it to reduce reachability of the vulnerable handler. Validate all changes against the PoC at https://github.com/Svigo-o/TOTOLINK-Vul, and consider replacing end-of-support SOHO hardware if no firmware fix appears.