Volerion logoVolerion
Volerion logoVolerion

ToToLink A3300R Command Injection Vulnerability in cgi-bin/cstecgi.cgi

Vulnerability

A command injection vulnerability has been identified in ToToLink A3300R firmware version 17.0.0cu.557_B20221024. The issue arises in the cgi-bin/cstecgi.cgi script, where the stunMaxAlive parameter can be manipulated to execute arbitrary commands. This vulnerability allows attackers to inject commands that are then executed by the device's operating system.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to /cgi-bin/cstecgi.cgi with the stunMaxAlive parameter set to a crafted value that includes the desired command. The injected command will be executed on the device.

Added: Apr 23, 2026, 8:12 PM
Updated: Apr 23, 2026, 8:12 PM

Vulnerability Rating

Custom Algorithm
spread
4.5
impact
7.5
exploitability
9.1
remediation
7.7
relevance
6.5
threat
6.4
urgency
2.9
incentive
8.3

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.