This vulnerability affects the Totolink A3300R router firmware 17.0.0cu.557_b20221024. The issue is located in the setIptvCfg function within the /cgi-bin/cstecgi.cgi CGI script. By manipulating the vlanPriLan3 parameter, an attacker can perform command injection remotely without user interaction or elevated privileges. The vulnerability has been publicly disclosed, but there is no vendor advisory or patch information available at this time. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising the router's integrity and availability. Given the medium CVSS score and low complexity of attack, this could lead to unauthorized control or disruption of network traffic managed by the device. However, no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the device's management interface and monitor for unusual activity. Avoid exposing the device's CGI interface to untrusted networks. Follow vendor communications for updates on patches or mitigations.