CVE-2026-5101

MEDIUM

Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection

Title source: cna

Description

A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

References (5)

[Signature, Permissions Required] https://vuldb.com/vuln/354126/cti

[Third Party Advisory] https://vuldb.com/submit/779128

[Exploit] https://github.com/Litengzheng/vul_db/blob/main/A3300R/vul_39/README.md

View Exploit ZIP pw:eip

[Vdb Entry, Technical Description] https://vuldb.com/vuln/354126

[Product] https://www.totolink.net/

Scores

CVSS v3 6.3

EPSS 0.0295

EPSS Percentile 86.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-74 CWE-77 CWE-78

Status published

Products (2)

Totolink/A3300R 17.0.0cu.557_b20221024

totolink/a3300r_firmware 17.0.0cu.557_b20221024

Published Mar 29, 2026

Tracked Since Mar 30, 2026