The vulnerability is a command injection flaw (CWE‑77) that allows an attacker to supply arbitrary shell commands through the pppoeMtu parameter of the /cgi-bin/cstecgi.cgi script on the ToToLink A3300R router. This flaw gives the attacker the ability to run commands with the privileges of the web service; it is inferred that this could compromise the device’s operating system and the data it handles. The impact includes risks to confidentiality, integrity, and availability on the affected network segment.

ToToLink A3300R routers running firmware version 17.0.0cu.557_B20221024.

The CVSS score of 6.5 indicates moderate severity and the EPSS score of <1% suggests a low current exploitation probability; the vulnerability is not listed in the CISA KEV catalog. The flaw exists in a web‑accessible script called /cgi-bin/cstecgi.cgi that accepts a pppoeMtu parameter. It is likely that a remote attacker with access to the router’s HTTP interface could send a specially crafted request to that endpoint and, using the command injection weakness, execute supplied commands with the privileges of the web service.