A flaw in the Totolink A3300R router firmware 17.0.0cu.557_b20221024 allows an attacker to inject arbitrary shell commands through the setSyslogCfg function in the /cgi-bin/cstecgi.cgi script. Because the command is executed with the router’s system privileges, successful exploitation can lead to full remote code execution, enabling an attacker to modify settings, retrieve configuration, or further compromise the device. The vulnerability arises from insufficient input validation and originates in the command injection weakness described by CWE-74 and the improper handling of system commands, CWE-77.

This vulnerability is specific to the Totolink A3300R router, particularly those running firmware version 17.0.0cu.557_b20221024. Earlier firmware releases that contain the same implementation of setSyslogCfg are also potentially affected. The CPE identifiers for the affected product include cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024, which represents the vulnerable firmware configuration.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of 5% suggests a relatively low probability of exploitation in the wild. However, the flaw can be triggered remotely without authentication, as the attack vector relies on making HTTP requests to the vulnerable CGI endpoint. Because the exploit code has been publicly released, the risk to devices exposed to the internet or accessible to hostile local actors is significant. The vulnerability is not listed in the CISA KEV catalog, but its nature of unvalidated command injection makes it a typical example of the CWE vulnerabilities listed.