The flaw is a classic command injection in the ttlWay parameter of the Totolink A3300R firmware’s /cgi-bin/cstecgi.cgi endpoint. Attackers who can reach the device’s web interface may supply crafted input to ttlWay, causing the firmware to run arbitrary system commands with the privileges of the CGI process. While complete device compromise is not explicitly confirmed, the potential for arbitrary command execution implies that an attacker could take full control of the router.

Totolink A3300R routers running firmware version 17.0.0cu.557_B20221024 are affected. No other versions are known to contain the vulnerable code.

The CVSS score of 6.5 signals a moderate to high severity. The EPSS score of less than 1 % indicates a very low but nonzero likelihood of exploitation according to current data. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that successful exploitation requires reaching the device’s web interface, either from the local network or from a publicly accessible LAN interface, and submitting a crafted ttlWay value. The description does not explicitly state whether authentication is required, so the risk involves the potential for unauthenticated or authenticated remote code execution, but this remains an inference.