This vulnerability affects Totolink A3300R firmware 17.0.0cu.557_B20221024. The issue is an OS command injection in the vsetTr069Cfg function of the /cgi-bin/cstecgi.cgi file. An attacker with at least low privileges can manipulate the stun_pass parameter to execute arbitrary OS commands. The CVSS 4.0 base score is 5.1 (medium severity), reflecting the attack vector as adjacent network with low attack complexity and no user interaction required. The vulnerability is publicly disclosed but no patch or official remediation level has been indicated by the vendor.

Successful exploitation allows an attacker with network access and low privileges to execute arbitrary operating system commands on the affected device. This could lead to unauthorized control or disruption of the router. However, no known active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious activity related to the vsetTr069Cfg function. Avoid exposing the device management interface to untrusted networks.