CVE-2026-31170 is a vulnerability in the ToToLink A3300R router firmware (v17.0.0cu.557_B20221024) that allows remote attackers to execute arbitrary commands through the stun-pass parameter in the /cgi-bin/cstecgi.cgi CGI script. The vulnerability arises from insufficient input validation or sanitization of this parameter, leading to command injection. No CVSS score or detailed technical analysis is provided, and no patch or mitigation is currently documented.

Successful exploitation could allow an attacker to execute arbitrary commands on the affected device, potentially leading to full compromise of the router. This could impact device availability, confidentiality, and integrity. However, no known exploits have been reported in the wild, and the extent of impact depends on attacker access to the vulnerable interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected CGI endpoint and monitor for suspicious activity. Avoid exposing the device management interface to untrusted networks.