The flaw allows an attacker to inject and execute arbitrary operating‑system commands through the provider parameter of /cgi-bin/cstecgi.cgi on the ToToLink A3300R router. This is a classic command‑injection vulnerability (CWE‑77) that can lead to full device compromise, data exfiltration, or takeover of the network segment in which the device resides. The impact is a loss of confidentiality, integrity and availability for the affected system and any networks it connects to.

ToToLink A3300R routers running firmware version 17.0.0cu.557_B20221024 are affected. The issue is tied to the /cgi-bin/cstecgi.cgi component exposed by the firmware. Any device that incorporates this firmware revision is vulnerable and must be examined for exploitation potential.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of < 1 % shows a very low current probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw permits remote command execution, the potential impact remains high. The attack vector is likely network‑based, requiring access to the router’s control interface and the ability to supply a crafted provider parameter value.