A function in the router’s firmware, vsetTr069Cfg, processes a parameter named stun_pass. By altering this argument an attacker can insert arbitrary operating‑system commands, leading to remote code execution on the device. Successful exploitation permits full control over the router, threatening the confidentiality, integrity, and availability of the device and any networks it serves.

The vulnerability affects the Totolink A3300R router running firmware version 17.0.0cu.557_B20221024. The issue resides in the /cgi-bin/cstecgi.cgi endpoint and is specific to that product line.

The CVSS score of 5.1 indicates moderate severity. The flaw exists in a web-accessible CGI script, but the description does not state whether the interface is publicly exposed. Based on the description, it is inferred that if /cgi-bin/cstecgi.cgi can be reached from outside the local network, an attacker could leverage the command injection without additional credentials. The EPSS score is less than 1% and the flaw is not listed in the CISA KEV catalog, suggesting limited widespread exploitation to date. Nevertheless, the potential impact remains significant if the script is externally accessible, allowing an attacker to execute arbitrary OS commands on the device.