What is the CVSS score of EUVD-2026-25255?

EUVD-2026-25255 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

TOTOLINK A3300R EUVD-2026-25255

| CVE-2026-31163 MEDIUM

Command Injection (CWE-77)

2026-04-23 mitre

GHSA-qwrp-93vh-6rc7

Command Injection N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.8 CRITICAL

Arbitrary OS command execution on embedded router firmware yields full confidentiality, integrity, and availability impact; PR:N per provided vector; AV:N as management interface is network-reachable.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:50 vuln.today

CVSS changed

Apr 23, 2026 - 19:27 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 23, 2026 - 19:00 euvd

EUVD-2026-25255

CVE Published

Apr 23, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the dhcpMtu parameter to /cgi-bin/cstecgi.cgi.

AnalysisAI

Command injection in TOTOLINK A3300R firmware v17.0.0cu.557_B20221024 exposes the router's CGI management interface to unauthenticated remote attackers who can execute arbitrary OS commands by injecting shell metacharacters into the dhcpMtu parameter of /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is available on GitHub, and SSVC assessment marks exploitation as automatable with partial technical impact. No vendor-released patch has been identified at time of analysis, leaving affected devices persistently vulnerable.

Technical ContextAI

The affected endpoint /cgi-bin/cstecgi.cgi is a common CGI dispatcher used in TOTOLINK router firmware to handle web-based configuration requests. The dhcpMtu parameter, which controls the DHCP Maximum Transmission Unit value passed to the router's networking subsystem, is forwarded to an underlying shell command without adequate sanitization. CWE-77 (Improper Neutralization of Special Elements used in a Command) describes this root cause: user-supplied input reaches a command interpreter with special characters - such as semicolons, backticks, or pipe operators - intact, allowing the attacker to append or inject arbitrary shell commands. The CPE data returned by NVD (cpe:2.3:a:n/a:n/a) is uninformative; the affected product is confirmed by firmware version string v17.0.0cu.557_B20221024 as documented in the researcher's GitHub advisory.

RemediationAI

No vendor-released patch has been identified at time of analysis. Users should check the TOTOLINK support portal for firmware updates targeting v17.0.0cu.557_B20221024 or later. As an immediate compensating control, disable remote WAN-side management access to the router's web interface if it is enabled - this restricts exploitation to attackers already on the LAN segment, substantially reducing exposure. If the router supports access control lists (ACLs) on the management interface, restrict access to specific trusted IP addresses. Placing the router behind a firewall that blocks external access to TCP port 80/443 of the management IP is also effective, though it does not remediate the underlying flaw. Replacing the device with a supported router model from a vendor that actively patches firmware is the only long-term mitigation given the absence of a patch. The researcher's PoC and disclosure are available at https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-dhcp-mtu-cmd-injection.