Description
A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Published: 2026-03-29
Score: 5.3 Medium
EPSS: 2.4% Low
KEV: No
Impact: Remote Command Execution
Action: Apply Patch
AI Analysis

Impact

Totolink A3300R firmware 17.0.0cu.557_b20221024 contains a command injection flaw in the setLanCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the lanIp parameter allows arbitrary shell commands to be executed on the device. This results in remote code execution, which is a critical compromise of the router’s system integrity.

Affected Systems

Devices running Totolink A3300R firmware 17.0.0cu.557_b20221024 are affected; the vulnerable component is the Parameter Handler accessed through the /cgi-bin/cstecgi.cgi endpoint.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity, and the EPSS score of 2 % shows a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting that widespread proof‑of‑concept exploits are not yet reported. Attackers can send a crafted HTTP request containing a tampered lanIp value directly to the router. Based on the description, it is inferred that authentication is not required to exploit this flaw, meaning a reachable router can be compromised without valid credentials.

Generated by OpenCVE AI on October 25, 2026 at 21:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the router to the latest firmware released by Totolink that resolves the command‑injection issue.
  • If an updated firmware is not available, block remote access to the /cgi‑bin/cstecgi.cgi endpoint with firewall or ACL rules to prevent external requests.
  • Disable remote management or all web‑based configuration interfaces that expose the vulnerable endpoint until a patch can be applied.
  • Continuously monitor device logs for unexpected use of the lanIp parameter or signs of command execution attempts.

Generated by OpenCVE AI on October 25, 2026 at 21:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 30 Mar 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-78
CPEs cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*
cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*

Mon, 30 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 30 Mar 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a3300r
Vendors & Products Totolink a3300r

Mon, 30 Mar 2026 03:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Title Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection
First Time appeared Totolink
Totolink a3300r Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:totolink:a3300r_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a3300r Firmware
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A3300r A3300r Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-30T14:52:01.775Z

Reserved: 2026-03-29T17:50:43.221Z

Link: CVE-2026-5101

cve-icon Vulnrichment

Updated: 2026-03-30T13:13:58.210Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-29T23:16:48.597

Modified: 2026-06-17T10:58:26.150

Link: CVE-2026-5101

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-25T21:45:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')