This vulnerability affects the Totolink A3300R router firmware 17.0.0cu.557_b20221024. The setUPnPCfg function in the /cgi-bin/cstecgi.cgi endpoint improperly handles the 'enable' argument, leading to command injection. This allows an unauthenticated remote attacker to execute arbitrary commands on the device. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. The vulnerability is publicly known but no vendor patch or mitigation details are currently available.

Successful exploitation could allow remote attackers to execute arbitrary commands on the affected device, potentially compromising the router's operation and security. The impact is rated medium based on the CVSS score of 5.3, reflecting limited but meaningful risk due to the ability to perform command injection remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting remote access to the device's management interface and monitor for unusual activity. Avoid exposing the router's management interface to untrusted networks. Follow updates from Totolink for any forthcoming patches or official mitigations.