A command injection flaw was found in the Totolink A3300R router’s web interface where an attacker can supply arbitrary commands in the interval parameter of the /cgi-bin/cstecgi.cgi endpoint. The flaw permits execution of any operating‑system command on the device, potentially giving an attacker full control over the router. The weakness is categorized as command injection (CWE-77).

All Totolink A3300R routers running firmware version 17.0.0cu.557_B20221024 are affected. Users of other firmware releases or hardware variants are not listed as vulnerable.

The vulnerability carries a CVSS score of 6.5, indicating a moderate severity, and an EPSS score of less than 1%, suggesting low current exploitation probability. It is not listed in CISA’s KEV catalog. Exploitation would likely involve crafting a malicious HTTP request to /cgi-bin/cstecgi.cgi with a manipulated interval value, sending it over the network to the exposed web interface. The description does not state whether authentication is required, so it is inferred that remote unauthenticated access could be sufficient, although that may depend on additional device settings.