Executive brief
A security vulnerability exists in the Totolink A3300R wireless router, a device used to provide internet connectivity in homes and small offices. An attacker with access to the local network can take control of the device by sending a specially crafted request to its management interface. This could allow an unauthorized user to disrupt internet service, intercept network traffic, or use the router as a foothold for further attacks on the internal network.
Technical details
An OS command injection vulnerability exists in the Totolink A3300R router firmware version 17.0.0cu.557_B20221024. The flaw is located within the vsetTr069Cfg function in /cgi-bin/cstecgi.cgi, where the application fails to properly sanitize the 'stun_pass' argument before passing it to a system execution function. Specifically, the sub_4100F0 function retrieves the stun_pass value and uses sprintf to concatenate it into a command string that is eventually executed via execv through the CsteSystem wrapper. An authenticated attacker with adjacent network access can exploit this by sending a crafted POST request containing shell metacharacters (e.g., $(command)) to achieve arbitrary code execution on the underlying Linux operating system. Public exploit code (PoC) has been disclosed.
Affected products
- Totolink A3300R 17.0.0cu.557_B20221024
Timeline
- 2026-04-06: disclosed: Vulnerability disclosed via VulDB and GitHub PoC
- 2026-04-06: advisory: NVD published the CVE record