Home / Vulnerability Intelligence / CVE-2026-31181

CVE-2026-31181 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: April 23, 2026

ToToLink A3300R - Command Injection

Published: April 23, 2026Updated: April 23, 2026Remote Exploitable

Overview

ToToLink A3300R firmware v17.0.0cu.557_B20221024 contains a command injection caused by improper sanitization of the stunServerAddr parameter in /cgi-bin/cstecgi.cgi, letting attackers execute arbitrary commands remotely, exploit requires network access.

Severity & Score

Severity: Critical

CVSS Score: 9.8

Impact

Attackers can execute arbitrary commands remotely, potentially leading to full system compromise.

Mitigation

Update to the latest firmware version.

References

https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-server-addr-cmd-injection

Related Resources

Details

CVE ID: CVE-2026-31181
Severity: Critical
CVSS Score: 9.8
Type: command_injection
Status: new

CWE

CWE-78

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H