CVE-2026-31181: Totolink a3300r Firmware

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to /cgi-bin/cstecgi.cgi.

Affected products

• Totolink a3300r Firmware: version 17.0.0cu.557_b20221024 only

Published 2026-04-23. Last modified 2026-06-17.