The TOTOLINK A3300R firmware contains a command‑injection flaw that can be triggered by supplying an arbitrary string to the stunPort parameter in the /cgi-bin/cstecgi.cgi endpoint. This allows an attacker to run arbitrary commands under the privileges of the router’s web daemon, potentially leading to full device compromise. The weakness is a classic instance of CWE‑77 (Command Injection).

Affected devices are TOTOLINK routers of the A3300R model running firmware version 17.0.0cu.557_B20221024. No product variations are listed beyond this firmware build, so any device identified by the CPE strings provided is likely vulnerable.

The CVSS score of 6.5 reflects a moderate severity, and the EPSS score of less than 1% indicates that real‑world exploitation is considered unlikely at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers would require network access to the router’s internal interface, typically from a local or compromised network segment. Based on the description, it is inferred that the exploit requires no special privileges beyond reaching the web service, and it could be performed by sending a crafted HTTP request to the exposed /cgi-bin/cstecgi.cgi endpoint.