EUVD-2026-25247
GHSA-r965-frwq-44xx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated network-accessible command injection on router firmware yields root OS execution and scope change affecting all downstream network clients.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun-port parameter to /cgi-bin/cstecgi.cgi.
AnalysisAI
Unauthenticated remote command injection in TOTOLINK A3300R firmware v17.0.0cu.557_B20221024 allows network-adjacent or internet-exposed attackers to execute arbitrary OS commands by injecting shell metacharacters into the stun-port parameter of /cgi-bin/cstecgi.cgi. The CVSS vector (PR:N/AC:L/UI:N) confirms no credentials or user interaction are required, and the SSVC assessment independently classifies the attack as automatable with a publicly available proof-of-concept - though EPSS at 0.04% (12th percentile) indicates minimal observed exploitation activity to date and no CISA KEV listing has been recorded. The vendor-assigned impact metrics (C:L/I:L/A:N) appear inconsistent with the expected consequence of OS-level command execution on router firmware, which typically yields full device compromise.
Technical ContextAI
The vulnerability resides in the TOTOLINK A3300R router's web-based management CGI handler (/cgi-bin/cstecgi.cgi), specifically in the routine that processes STUN (Session Traversal Utilities for NAT) port configuration. CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies the root cause: attacker-controlled input to the stun-port parameter is concatenated directly into a shell command without sanitization, allowing injection of arbitrary shell metacharacters. TOTOLINK routers in this family run embedded Linux on MIPS architecture; the web management process typically executes with root privileges, so successful injection grants full OS control. The affected firmware build is v17.0.0cu.557_B20221024. The CPE string is listed as cpe:2.3:a:n/a:n/a in NVD, indicating incomplete vendor product registration and limiting automated tooling coverage.
RemediationAI
No vendor-released patch has been identified at the time of analysis; patch availability per vendor advisory has not been confirmed. The primary compensating control is to disable WAN-side access to the router's web management interface immediately - this blocks unauthenticated remote exploitation from the internet while preserving LAN administration capability. If the STUN or NAT traversal feature is not actively required, disabling it via alternative configuration paths reduces the exposed attack surface, though this does not eliminate the vulnerability in the CGI handler itself. If no firmware patch is released by TOTOLINK, replacing the A3300R with a supported device receiving active security updates is the recommended long-term remediation. Monitor the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-31179 and TOTOLINK's official channels for patch availability. The researcher PoC repository at https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-port-cmd-injection may contain additional technical detail useful for developing detection signatures.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today