An injection flaw exists in the ToToLink A3300R firmware allowing an attacker to supply arbitrary shell commands through the *user* parameter of the /cgi-bin/cstecgi.cgi endpoint. This vulnerability, classified as CWE‑77, can lead to remote command execution, compromising the confidentiality, integrity, and availability of the device. The description does not explicitly state the attack vector, but it is inferred that an attacker can exploit this by sending a crafted HTTP request containing the malicious *user* value to the CGI script.

The affected device is the ToToLink A3300R router running firmware version 17.0.0cu.557_B20221024. The corresponding CPEs reference this exact model and firmware build. Any identical or newer builds not yet updated may also be at risk until a release that addresses the vulnerability is applied.

The CVSS base score of 6.5 reflects a medium severity. The EPSS score is reported as less than 1 %, indicating a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the information provided, the likely attack vector involves sending a crafted HTTP request to the vulnerable CGI endpoint over the network, requiring no special privileges or physical access. Therefore, the primary risk is remote code execution from an external origin.