CVE-2026-31164: Totolink a3300r Firmware

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to /cgi-bin/cstecgi.cgi.

Affected products

• Totolink a3300r Firmware: version 17.0.0cu.557_b20221024 only

Published 2026-04-23. Last modified 2026-06-17.