Cyber Posture

CVE-2026-31177

CriticalPublic PoCRCE

Published: 23 April 2026

Published
23 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0041 61.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-31177 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink A3300R Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the command injection vulnerability by enforcing validation of the stunMinAlive parameter in the cstecgi.cgi script to block arbitrary OS command execution.

prevent

Addresses the specific flaw in ToToLink A3300R firmware v17.0.0cu.557_B20221024 through timely remediation, such as applying patches to fix insufficient input validation.

prevent

Prevents command injection by restricting or filtering malicious inputs like shell metacharacters in the stunMinAlive parameter before processing by the CGI component.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
Why these techniques?

CVE enables unauthenticated remote exploitation of a public-facing web application (T1190) on a network device, directly facilitating arbitrary OS command execution via command injection (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi.

Deeper analysisAI

CVE-2026-31177 is a command injection vulnerability (CWE-78) discovered in ToToLink A3300R firmware version v17.0.0cu.557_B20221024. The flaw resides in the /cgi-bin/cstecgi.cgi component, where insufficient input validation on the stunMinAlive parameter enables attackers to inject and execute arbitrary operating system commands.

With a CVSS v3.1 base score of 9.8 (Critical), the vulnerability is exploitable remotely over the network (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) or user interaction (UI:N). Attackers can achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) by executing arbitrary commands, potentially leading to full device compromise, such as root shell access or persistent backdoors on affected routers.

Proof-of-concept exploit code is publicly available on GitHub at https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-min-alive-cmd-injection. No vendor advisories, patches, or official mitigation guidance are referenced in the CVE details.

Details

CWE(s)

Affected Products

totolink
a3300r firmware
17.0.0cu.557_b20221024

CVEs Like This One

CVE-2026-31178Same product: Totolink A3300R
CVE-2026-31181Same product: Totolink A3300R
CVE-2026-5178Same product: Totolink A3300R
CVE-2026-5105Same product: Totolink A3300R
CVE-2025-52046Same product: Totolink A3300R
CVE-2026-5176Same product: Totolink A3300R
CVE-2026-5101Same product: Totolink A3300R
CVE-2025-12241Same product: Totolink A3300R
CVE-2025-12239Same product: Totolink A3300R
CVE-2025-12259Same product: Totolink A3300R

References