An input validation flaw in the stunMaxAlive parameter of the Totolink A3300R firmware version 17.0.0cu.557_B20221024 allows an attacker to inject and execute arbitrary commands via the /cgi-bin/cstecgi.cgi endpoint. The vulnerability is a classic CWE‑78 command injection weakness that can compromise the host’s confidentiality, integrity, and availability by enabling full remote code execution. The impact is limited to systems where the vulnerable firmware is in use and the CGI endpoint is accessible from an attacker’s network.

The flaw affects the Totolink A3300R device running firmware 17.0.0cu.557_B20221024. No other vendors or product versions are listed as impacted.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the device’s web interface and the ability to craft a request to the cstecgi.cgi script. Once the request reaches the device, the injected command is executed with system privileges, enabling full control over the affected router.