A function in the router’s firmware, vsetTr069Cfg, processes a parameter named stun_pass. By altering this argument an attacker can insert arbitrary operating‑system commands, leading to remote code execution on the device. Successful exploitation permits full control over the router, threatening the confidentiality, integrity, and availability of the device and any networks it serves.

The vulnerability affects the Totolink A3300R router running firmware version 17.0.0cu.557_B20221024. The issue resides in the /cgi-bin/cstecgi.cgi endpoint and is specific to that product line.

The CVSS score of 5.1 indicates a moderate severity, but the flaw is reachable through a web interface that is accessible from outside the local network. No EPSS value is reported and the flaw is not listed in the CISA KEV catalog, which may imply limited public exploitation so far. Nevertheless, the combination of web exposure and command injection grants an attacker the ability to remotely execute arbitrary commands without additional credentials, making the risk significant.