The SentinelOne Annual Threat Report - A Defenders Guide from the FrontlinesThe SentinelOne Annual Threat ReportGet the Report
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2026-31169

CVE-2026-31169: Totolink A3300R Firmware RCE Vulnerability

CVE-2026-31169 is a remote code execution flaw in Totolink A3300R Firmware that enables attackers to execute arbitrary commands via the week parameter. This article covers technical details, affected versions, and mitigation.

Updated: May 14, 2026

CVE-2026-31169 Overview

CVE-2026-31169 is a command injection vulnerability in ToToLink A3300R firmware version 17.0.0cu.557_B20221024. The flaw resides in the /cgi-bin/cstecgi.cgi endpoint, where the week parameter is passed to a shell context without proper sanitization. Remote attackers can supply crafted input to execute arbitrary operating system commands on the affected router. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). Exploitation requires network access to the device's web management interface but does not require authentication or user interaction.

Critical Impact

Unauthenticated remote attackers can execute arbitrary commands on vulnerable ToToLink A3300R routers, enabling device compromise and persistent foothold on the network edge.

Affected Products

  • ToToLink A3300R router hardware
  • ToToLink A3300R firmware version 17.0.0cu.557_B20221024
  • Networks exposing the affected router's web management interface

Discovery Timeline

  • 2026-04-23 - CVE-2026-31169 published to the National Vulnerability Database
  • 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31169

Vulnerability Analysis

The vulnerability is a classic OS command injection in the router's CGI handler. The cstecgi.cgi binary processes HTTP requests directed at administrative functions on the A3300R. When the handler reads the week parameter, it incorporates the value into a shell command without sanitizing metacharacters such as ;, |, &, or backticks. Attackers supplying shell control characters can break out of the intended command context and append commands of their choosing. The injected commands execute with the privileges of the web service, which typically run as root on consumer routers. Successful exploitation yields arbitrary code execution on the device, enabling configuration tampering, traffic interception, or pivoting to internal hosts.

Root Cause

The root cause is improper neutralization of special elements in the week parameter ([CWE-77]). The CGI handler passes user-controlled input to a system shell invocation, likely through system(), popen(), or a similar API. No allowlist validation or escaping is applied before the shell parses the argument.

Attack Vector

The attack vector is network-based against the HTTP management service exposed by the router. An attacker sends a crafted POST or GET request to /cgi-bin/cstecgi.cgi containing a malicious week parameter value. Because authentication is not required to reach the vulnerable code path, attackers on the LAN — or on the WAN if remote management is enabled — can trigger the flaw directly.

No verified exploit code is included here. Technical details and a proof-of-concept are documented in the GitHub PoC Repository.

Detection Methods for CVE-2026-31169

Indicators of Compromise

  • HTTP requests to /cgi-bin/cstecgi.cgi containing shell metacharacters (;, |, &, `, $()) within the week parameter value.
  • Unexpected outbound connections originating from the router to attacker-controlled infrastructure.
  • Unauthorized changes to router DNS settings, firewall rules, or administrative credentials.

Detection Strategies

  • Inspect network traffic destined for the router management interface for anomalous cstecgi.cgi request patterns and non-printable characters in form fields.
  • Deploy network IDS rules that flag command injection payloads targeting week= parameters on TOTOLINK CGI endpoints.
  • Correlate router-originated traffic with endpoint telemetry to identify lateral movement attempts following device compromise.

Monitoring Recommendations

  • Centralize router syslog output and alert on authentication anomalies or configuration changes outside maintenance windows.
  • Monitor DNS resolution patterns from devices behind the router for signs of DNS hijacking common in router compromises.
  • Track firmware version and configuration drift across deployed routers to detect tampering.

How to Mitigate CVE-2026-31169

Immediate Actions Required

  • Block external access to the router's web management interface and restrict administrative access to trusted internal hosts.
  • Disable remote management (WAN-side administration) on all affected A3300R devices until a vendor patch is applied.
  • Inventory deployed ToToLink A3300R devices and confirm firmware versions against the vulnerable build 17.0.0cu.557_B20221024.

Patch Information

No vendor advisory or patch is referenced in the published CVE data at the time of writing. Administrators should monitor the ToToLink support site for firmware updates addressing CVE-2026-31169 and apply them as soon as they become available.

Workarounds

  • Place affected routers behind a perimeter firewall that filters access to TCP ports used by the web management interface.
  • Segment IoT and network infrastructure devices onto a dedicated VLAN to limit blast radius if a router is compromised.
  • Replace end-of-support or unpatchable consumer routers with vendor-maintained hardware that receives security updates.
bash
# Example iptables rule to restrict access to the router management interface
# Allow only a trusted management workstation (192.0.2.10) to reach port 80/443 on the router
iptables -A INPUT -p tcp -s 192.0.2.10 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -s 192.0.2.10 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypeRCE

  • Vendor/TechTotolink

  • SeverityMEDIUM

  • CVSS Score6.5

  • EPSS Probability0.26%

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityNone
  • CWE References
  • CWE-77
  • Technical References
  • GitHub PoC Repository
  • Related CVEs
  • CVE-2026-7633: Totolink N300RH RCE Vulnerability

  • CVE-2026-7823: Totolink A8000RU RCE Vulnerability

  • CVE-2026-7721: Totolink WA300 RCE Vulnerability

  • CVE-2026-7718: Totolink WA300 RCE Vulnerability
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English