A command injection flaw exists in the setVpnPassCfg function of the cstecgi.cgi component on Totolink A3300R routers. By manipulating the pptpPassThru argument, an attacker can inject and execute arbitrary shell commands remotely, which can lead to full compromise of the device's configuration, data, and network connectivity. The weakness is reflected in the CVSS score of 5.3, indicating a moderate level of severity from a security standpoint.

The affected systems are Totolink A3300R routers running firmware version 17.0.0cu.557_b20221024. No other vendors or product lines are listed as impacted in the CVE data.

The attack vector is remote, leveraging the router’s web interface or API that accepts the pptpPassThru parameter. An exploit is publicly available, and no official CISA KEV listing is attached, but the public availability of the exploit combined with the absence of a patch raises the risk of abuse. Although the EPSS score is not provided, the remote command execution potential warrants heightened vigilance and timely firmware remediation.