The vulnerability allows an attacker to inject arbitrary system commands through the informEnable parameter in the /cgi-bin/cstecgi.cgi interface. This is a classic command injection flaw (CWE‑77) that can give an attacker full control over the affected device. The impact is serious in that an attacker can read, modify, or delete configuration data, install additional software, or use the device as a pivot for further attacks in the network. No information is provided about the need for authentication, so it is unlikely to be limited to privileged users.

Totolink A3300R routers running firmware version 17.0.0cu.557_B20221024 are affected. The vulnerability is tied to the cgi-bin interface and the informEnable parameter within that firmware.

The CVSS score of 6.5 indicates the flaw is moderate, and the EPSS score of less than 1% suggests the likelihood of real-world exploitation is low at present. The vulnerability has not been listed in the CISA KEV catalog, which further reduces the current threat posture. The likely attack vector is through a remote HTTP or HTTPS request sent to /cgi-bin/cstecgi.cgi with a crafted informEnable value. An attacker with network access to the device or an exposed management interface would be able to exploit this flaw.