Description
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the recHour parameter to /cgi-bin/cstecgi.cgi.
Published: 2026-04-23
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Execution via command injection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability permits an attacker to execute arbitrary shell commands through the recHour parameter in the /cgi-bin/cstecgi.cgi endpoint of the ToToLink A3300R router firmware. This is a classic command injection flaw (CWE-77). Based on the description, it is inferred that such exploitation could lead to the execution of arbitrary commands that compromise the device’s confidentiality, integrity, or availability.

Affected Systems

ToToLink A3300R routers running firmware version 17.0.0cu.557_B20221024 are vulnerable. The recHour parameter is exposed via the web interface’s CGI endpoint.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. The EPSS score of <1% signals a low probability of exploitation, and the vulnerability does not appear in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is through the web‑based management interface, requiring an HTTP request that manipulates the recHour parameter.

Generated by OpenCVE AI on April 28, 2026 at 15:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router firmware to a version where the command injection vulnerability is fixed.
  • If an upgrade is not immediately possible, restrict or block access to the /cgi-bin/cstecgi.cgi endpoint using firewall rules or by disabling the associated service in the device configuration.
  • Limit the router’s administrative interface to known, trusted IP ranges and enforce strict authentication so only authorized personnel can reach the vulnerable endpoint.

Generated by OpenCVE AI on April 28, 2026 at 15:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 15:30:00 +0000

Type Values Removed Values Added
Title Command Injection via recHour Parameter in ToToLink A3300R Firmware

Mon, 27 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink a3300r
Totolink a3300r Firmware
CPEs cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*
cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a3300r
Totolink a3300r Firmware

Thu, 23 Apr 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-77
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Apr 2026 18:45:00 +0000

Type Values Removed Values Added
Description An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the recHour parameter to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink A3300r A3300r Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-04-23T18:56:59.016Z

Reserved: 2026-03-09T00:00:00.000Z

Link: CVE-2026-31168

cve-icon Vulnrichment

Updated: 2026-04-23T18:56:53.583Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-23T19:17:24.987

Modified: 2026-04-27T14:55:58.927

Link: CVE-2026-31168

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T15:15:34Z

Weaknesses