A critical command injection vulnerability in ToToLink A3300R firmware allows unauthenticated remote attackers to gain full system control.

The device fails to properly sanitize input in the stunServerAddr parameter within the /cgi-bin/cstecgi.cgi script, allowing for unauthenticated remote command execution.

This vulnerability carries a CVSS score of 9.8, reflecting its potential for total system compromise. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the web server, potentially leading to complete loss of confidentiality, integrity, and availability of the device and potential pivot points into the internal network.

Immediate Action: Check the ToToLink support portal for the latest firmware release and apply it immediately to all affected A3300R units.

Proactive Monitoring: Monitor network traffic for suspicious requests directed at /cgi-bin/cstecgi.cgi and review system logs for unexpected process execution.

Compensating Controls: Restrict access to the device's web management interface to trusted IP addresses via firewall rules and disable remote management if not strictly required.

Public Exploit Available: No (exploit_available: unknown)

Given the critical severity and the existence of a public proof-of-concept, immediate action is required to secure these devices. Administrators should verify the current firmware version and prioritize the application of vendor-supplied patches to prevent unauthorized remote command execution.