CVE-2026-31178
Published: 23 April 2026
Summary
CVE-2026-31178 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink A3300R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-31178 is a command injection vulnerability (CWE-78) discovered in the TOTOLINK A3300R firmware version v17.0.0cu.557_B20221024. The issue resides in the /cgi-bin/cstecgi.cgi endpoint, where the stunMaxAlive parameter fails to properly sanitize user input, enabling attackers to inject and execute arbitrary operating system commands.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impact across confidentiality, integrity, and availability. Remote, unauthenticated attackers can exploit it by sending a malicious HTTP request to the affected endpoint, achieving arbitrary command execution on the router with the privileges of the web server process.
Proof-of-concept exploit code demonstrating the command injection is publicly available in the GitHub repository https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-max-alive-cmd-injection. No vendor advisories, patches, or specific mitigation guidance are detailed in the provided references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25246
Vulnerability details
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to /cgi-bin/cstecgi.cgi.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables exploitation of a public-facing web application (T1190) on a network device router, directly facilitating arbitrary command execution via command injection (T1059.008: Network Device CLI).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents command injection by requiring validation and sanitization of the unsanitized stunMaxAlive parameter in the /cgi-bin/cstecgi.cgi endpoint.
Mitigates the vulnerability through timely remediation of the command injection flaw in the TOTOLINK A3300R firmware.
Enforces boundary protection at the router's external web interface to inspect and block malicious requests exploiting the vulnerable stunMaxAlive parameter.