Remote command execution via unsanitized enable parameter

OS command injection in TOTOLINK A3300R 17.0.0cu.557_B20221024 allows remote attackers to execute commands through its management API. The setPortForwardRules handler passes the unvalidated enable value to Uci_Set_Str, which builds a UCI command that CsteSystem sends to execv; the published request uses shell metacharacters to write command output into a web-accessible file. The proof uses a session token, while CISA's assessment lists no privileges required, so public evidence leaves the authentication gate unresolved; successful exploitation runs commands with the router service's permissions.