The vulnerability lies in ToToLink A3300R firmware version 17.0.0cu.557_B20221024, where the stun‑pass parameter sent to /cgi-bin/cstecgi.cgi does not properly validate input. An attacker who can submit a crafted request can inject and execute arbitrary operating system commands on the device. This results in full compromise of the device, exposing any data it processes and allowing the attacker to use the device in further attacks.

The affected hardware is the ToToLink A3300R router running firmware v17.0.0cu.557_B20221024. No other vendor or product variants are listed in the advisory. The flaw specifically impacts the web interface that processes the stun‑pass parameter for STUN configuration.

The CVSS score of 9.8 reflects a severe impact and remote exploitation possibility. Although the EPSS score is below 1%, indicating a low popularity of observed exploits, the lack of a security advisory in the KEV catalog suggests no confirmed exploit. The likely attack vector is remote HTTP(S) access to the device; the description infers that exploitation requires sending an HTTP request containing a shell escape in the stun‑pass field. No other prerequisites are disclosed, so any authenticated or unauthenticated attacker able to reach the device could likely succeed.