An OS command‑injection flaw in the ToToLink A3300R firmware allows an attacker to arbitrarily execute commands by supplying malicious input in the dhcpMtu parameter to the /cgi-bin/cstecgi.cgi endpoint. This vulnerability, identified as CWE‑77, gives an attacker control over system commands, potentially leading to full device compromise. The CVE description does not specify authentication requirements, so it is unclear whether authentication is required for exploitation.

The flaw affects only the ToToLink A3300R router running firmware version 17.0.0cu.557_B20221024. No other products or versions are listed as impacted.

The CVSS score of 6.5 reflects moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The flaw is not currently listed in the CISA KEV catalog. Based on the endpoint and parameter names, it is inferred that the attack is launched remotely over the network, but the CVE description does not state whether authentication is required.