Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

ToToLink A3300R Firmware Remote Command Execution

CVE-2026-31170 · published 6 months ago
Summary

An attacker can run arbitrary commands on your ToToLink A3300R router, potentially taking control of it. This affects the firmware version 17.0.0cu.557_B20221024. To fix this, update your router's firmware to the latest version from the manufacturer's website.

Original advisory text
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun-pass parameter to /cgi-bin/cstecgi.cgi.
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun-pass parameter to /cgi-bin/cstecgi.cgi.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-77Command Injection
Timeline
Published9 Apr 2026
Updated4 Nov 2026
First seen9 Apr 2026
Sources
CVE-2026-31170 · NVD
Track software like this
Free during beta