Home / Vulnerability Intelligence / CVE-2026-31172

CVE-2026-31172 - Vulnerability Analysis

MediumCVSS: 6.5

Last Updated: April 24, 2026

ToToLink A3300R - Command Injection

Published: April 23, 2026Updated: April 24, 2026PoC AvailableRemote Exploitable

Overview

ToToLink A3300R firmware v17.0.0cu.557_B20221024 contains a command injection caused by unsanitized user parameter in /cgi-bin/cstecgi.cgi, letting attackers execute arbitrary commands remotely, exploit requires no special privileges.

Severity & Score

Severity: Medium

CVSS Score: 6.5

Impact

Attackers can execute arbitrary commands remotely, potentially leading to full system compromise.

Mitigation

Update to the latest firmware version.

References

https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-user-cmd-injection

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-31172
Severity: Medium
CVSS Score: 6.5
Type: command_injection
Status: confirmed

CWE

CWE-77

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N