CVE-2026-5101

MEDIUM

Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection

Title source: cna

Description

A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

References (5)

Core 5

Core References

Signature, Permissions Required signature permissions-required

VDB-354126 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/354126/cti

Third Party Advisory third-party-advisory

Submit #779128 | Totolink A3300R 17.0.0cu.557_b20221024 Command Injection

https://vuldb.com/submit/779128

Exploit exploit

https://github.com/Litengzheng/vul_db/blob/main/A3300R/vul_39/README.md

View Exploit ZIP pw:eip

Vdb Entry, Technical Description vdb-entry technical-description

VDB-354126 | Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection

https://vuldb.com/vuln/354126

Product product

https://www.totolink.net/

Scores

CVSS v3 6.3

EPSS 0.0218

EPSS Percentile 80.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-74 CWE-77 CWE-78

Status published

Products (2)

Totolink/A3300R 17.0.0cu.557_b20221024

totolink/a3300r_firmware 17.0.0cu.557_b20221024

Published Mar 29, 2026

Tracked Since Mar 30, 2026