An attacker can supply a malicious value for the hour parameter in the /cgi-bin/cstecgi.cgi CGI endpoint on the Totolink A3300R router. The firmware v17.0.0cu.557_B20221024 fails to sanitise this input, so a crafted command is passed to the underlying shell, giving the attacker the ability to execute arbitrary commands on the device. This is a classic command injection flaw (CWE‑77) that can compromise the confidentiality, integrity or availability of the router and any devices on its network.

The affected system is the Totolink A3300R consumer router, running firmware 17.0.0cu.557_B20221024. The vulnerability is exposed through the web interface or the HTTP/HTTPS services that host the /cgi-bin/cstecgi.cgi script. Only this firmware version is currently listed as vulnerable; earlier or later builds may be unaffected.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is below 1 %, meaning that public exploitation is unlikely at present, and the vulnerability is not included in the CISA KEV catalog. Nevertheless, any attacker who can reach the affected router over the network – whether internally or from the internet – could exploit the flaw without authentication, potentially leading to full control of the device. The attack vector is inferred to be remote via the HTTP service, but the vulnerability would be easier to exploit if the router is exposed to untrusted networks.