Volerion logoVolerion
Volerion logoVolerion

ToToLink A3300R Command Injection Vulnerability in cgi-bin/cstecgi.cgi

Vulnerability

A command injection vulnerability has been identified in ToToLink A3300R firmware version 17.0.0cu.557_B20221024. The issue arises in the cgi-bin/cstecgi.cgi script, where the informEnable parameter can be manipulated to execute arbitrary commands. This vulnerability allows attackers to send crafted requests that are processed by the device, leading to unauthorized command execution.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to /cgi-bin/cstecgi.cgi with the informEnable parameter set to a crafted value that includes a command payload. The device will execute the injected command, demonstrating the command injection vulnerability.

Added: Apr 23, 2026, 6:58 PM
Updated: Apr 23, 2026, 6:58 PM

Vulnerability Rating

Custom Algorithm
spread
4.5
impact
7.5
exploitability
9.1
remediation
7.7
relevance
6.5
threat
6.4
urgency
2.9
incentive
8.3

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.