CVE-2026-31164 Details
Description
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to /cgi-bin/cstecgi.cgi.
A command injection vulnerability has been identified in ToToLink A3300R firmware version 17.0.0cu.557_B20221024. The issue allows attackers to execute arbitrary commands by exploiting the pppoeMtu parameter in the cgi-bin/cstecgi.cgi script. The vulnerability arises because the sub_422380 function retrieves the pppoeMtu value from the request and passes it to the Uci_Set_Str function, which concatenates it into a command that is executed via the CsteSystem function.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-pppoe-mtu-cmd-injection | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-pppoe-mtu-cmd-injection | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| totolink a3300r firmware | 17.0.0cu.557_b20221024 |
CPE
Remediation
| |
| totolink a3300r | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 23, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | New CVE Received | [email protected] |