CVE-2026-31181 -- CVSS 9.8 Vulnerability Briefing
CVE-2026-31181 | CVSS 9.8 (Critical) | Exploit: No known exploit
What Is It
CVE-2026-31181 is a critical OS command injection vulnerability in the Totolink A3300R router firmware version v17.0.0cu.557_B20221024, exploitable through the device's web management interface via the CGI endpoint.
Technical Detail
The flaw exists in the handling of the stunServerAddr parameter submitted to /cgi-bin/cstecgi.cgi, where user-supplied input is passed to a system-level function without adequate sanitization or validation. An attacker who can reach the management interface can inject arbitrary shell commands through this parameter, achieving unauthenticated remote code execution on the underlying Linux-based firmware. Successful exploitation grants full control of the device, enabling persistent access, traffic interception, lateral movement into connected networks, or use of the device as a network pivot point.
Exploitation Status
No known exploit code has been publicly observed or confirmed at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit, meaning no public proof-of-concept or weaponized tooling has been identified as of April 30, 2026. However, the simplicity of command injection vulnerabilities in CGI-based router interfaces historically means that functional exploits can be developed quickly once a vulnerability is disclosed.
Who Is Targeting This
No specific threat actor attribution at this time. No campaigns, threat groups, or targeted sectors have been linked to exploitation of this vulnerability. Totolink devices as a product class have historically been targeted by botnet operators, particularly those deploying Mirai variants, but no confirmed activity against this specific CVE has been reported.
What To Do
Organizations and individuals operating the Totolink A3300R should immediately check whether a firmware update superseding v17.0.0cu.557_B20221024 has been released by the vendor and apply it without delay given the critical CVSS score of 9.8. If no patch is available, restrict access to the device's web management interface by disabling remote management and binding administration access to trusted internal network segments only, using firewall rules or ACLs to block external access to the CGI endpoint. Network defenders should monitor for anomalous outbound connections or unexpected process execution originating from edge devices. If the device cannot be patched or adequately isolated, consider replacing it with a supported device that receives active security maintenance.