The Totolink A3300R router firmware 17.0.0cu.557_b20221024 contains a command injection vulnerability in the setStaticRoute function of /cgi-bin/cstecgi.cgi. By manipulating the ip parameter, an attacker can execute arbitrary commands remotely. The vulnerability is remotely exploitable without authentication or user interaction, but with low complexity and limited scope. The CVSS 4.0 score of 5.3 reflects a medium severity impact. There is no information on available patches or vendor advisories, and no known active exploitation has been reported.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising the router's integrity and control. This could lead to unauthorized configuration changes or further network compromise. However, the medium CVSS score and lack of known exploits suggest limited immediate widespread impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to the router's management interface and monitor for unusual activity related to the setStaticRoute function. Avoid exposing the device's administrative interface to untrusted networks.