This vulnerability affects the Totolink A3300R router firmware 17.0.0cu.557_b20221024. The flaw exists in the Parameter Handler component, specifically in the setSmartQosCfg function of the /cgi-bin/cstecgi.cgi file. By manipulating the qos_up_bw argument, an attacker can perform command injection remotely without authentication. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impact. The vulnerability was published on 2026-03-30, and a public exploit is available, but no vendor patch or official fix has been documented.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising the router's confidentiality, integrity, and availability to a limited extent. This could lead to unauthorized control or disruption of network traffic managed by the device. However, the impact is rated medium due to limited scope and no evidence of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting remote access to the device's management interface and monitor for unusual activity. Avoid exposing the device's CGI interface to untrusted networks. Follow vendor channels for updates on patches or mitigations.