CVE-2026-31177
Published: 23 April 2026
Summary
CVE-2026-31177 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink A3300R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-31177 is a command injection vulnerability (CWE-78) discovered in ToToLink A3300R firmware version v17.0.0cu.557_B20221024. The flaw resides in the /cgi-bin/cstecgi.cgi component, where insufficient input validation on the stunMinAlive parameter enables attackers to inject and execute arbitrary operating system commands.
With a CVSS v3.1 base score of 9.8 (Critical), the vulnerability is exploitable remotely over the network (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) or user interaction (UI:N). Attackers can achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) by executing arbitrary commands, potentially leading to full device compromise, such as root shell access or persistent backdoors on affected routers.
Proof-of-concept exploit code is publicly available on GitHub at https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-min-alive-cmd-injection. No vendor advisories, patches, or official mitigation guidance are referenced in the CVE details.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25245
Vulnerability details
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated remote exploitation of a public-facing web application (T1190) on a network device, directly facilitating arbitrary OS command execution via command injection (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the command injection vulnerability by enforcing validation of the stunMinAlive parameter in the cstecgi.cgi script to block arbitrary OS command execution.
Addresses the specific flaw in ToToLink A3300R firmware v17.0.0cu.557_B20221024 through timely remediation, such as applying patches to fix insufficient input validation.
Prevents command injection by restricting or filtering malicious inputs like shell metacharacters in the stunMinAlive parameter before processing by the CGI component.