A command injection flaw exists in the /cgi-bin/cstecgi.cgi handler of ToToLink A3300R firmware, which allows an attacker to supply an arbitrary string in the stun_user parameter and execute arbitrary OS commands on the device. This vulnerability can compromise confidentiality, integrity, and availability by enabling a malicious user to take full control of the router.

The vulnerability affects ToToLink A3300R devices running firmware version 17.0.0cu.557_B20221024. No other affected product versions are publicly documented.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is below 1%, suggesting a low probability that the flaw will be actively exploited in the near term, and the vulnerability is not yet listed in the CISA KEV catalog. The attack vector is inferred to be remote over the network, as the vulnerable CGI endpoint is accessible via standard HTTP requests. If an attacker can reach the device, they can invoke arbitrary commands and potentially compromise the entire system.