External risk intelligence

ToToLink A3300R Firmware Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-31170

The vulnerability affects a consumer router, a device designed to serve as an internet edge gateway. The vulnerable CGI endpoint is part of the device's web management interface, which is commonly exposed to the network to facilitate configuration and administration, making it a public-facing service in standard deployment scenarios.

Totolink A3300r Firmware

17.0.0cu.557_b20221024

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in ToToLink router firmware that could allow unauthorized individuals to execute commands remotely. This vulnerability affects a device often positioned at the network's edge, potentially opening a pathway for exploitation. The main concern is confirming if this specific technology is in use and exposed.

Attackers can run commands remotely.
It affects internet edge devices.
Confirm if used and exposed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted commands to the router's web interface, specifically targeting the `/cgi-bin/cstecgi.cgi` endpoint through the `stun-pass` parameter. This allows an unauthenticated attacker to execute arbitrary commands on the device, potentially leading to a complete compromise.

Unauthenticated network access required.
Triggered via a web request parameter.
Arbitrary command execution possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the affected device through a specially crafted request to its web management interface. This could potentially impact the device's normal operation and any data it processes or stores.

Router command execution.
Via a web interface parameter.
Device misconfiguration or disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects consumer routers, likely managed by network or infrastructure teams, with potential ownership by vendor management if third-party support is involved. The first practical step is to identify all instances of the affected device on the network, determine their internet exposure, and confirm business criticality before planning remediation.

Network/Infrastructure teams own the issue.
Verify device internet exposure and criticality.
Plan remediation and coordinate with the vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ToToLink A3300R?

The ToToLink A3300R is a consumer wireless router. It functions as a gateway device that manages network traffic, providing connectivity for home or small office devices while routing data between local machines and the internet.

What does CWE-77 mean for CVE-2026-31170?

CWE-77 is a weakness class known as Improper Neutralization of Special Elements used in an OS Command. In this CVE, it means the router software fails to properly filter user input. Consequently, an attacker can insert their own system commands into a specific web request parameter, tricking the device into executing unauthorized actions.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a crafted HTTP request to the device's web management interface. Specifically, they inject malicious commands into the 'stun-pass' parameter found within the '/cgi-bin/cstecgi.cgi' path. Note that simple, legitimate web traffic to the router that does not include these specific, manipulated parameters will not trigger the command execution.

Is my ToToLink A3300R at risk?

Halo Surface Signal notes that because this device acts as an internet edge gateway, its web management interface is often accessible from the network. If your router's management page is exposed to the internet, it is at higher risk of being targeted by unauthorized external users compared to devices restricted to internal management only.

What should I do if I use this router?

Begin by auditing your network to locate all instances of the A3300R. Determine if these units are configured to allow external access to their web management interfaces and evaluate their importance to your operations. Once you have identified these devices, coordinate with the vendor or your support provider to prepare for remediation.

References

github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-p…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.