Description
A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Published: 2026-03-29
Score: 5.3 Medium
EPSS: 2.9% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises from the setLanCfg function in /cgi-bin/cstecgi.cgi, where an attacker can inject arbitrary commands through the lanIp parameter. This results in remote code execution on the router, allowing full control of the device. The weakness corresponds to command injection (CWE‑77) and parameter injection (CWE‑74).

Affected Systems

Totolink A3300R routers running firmware version 17.0.0cu.557_b20221024 are affected. The issue resides in the Parameter Handler component exposed via the web interface.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity, but remote exploitation is possible from any network location. An attacker can trigger the injection via a crafted HTTP request to the setLanCfg endpoint, and publicly available exploits exist, increasing the risk. Since EPSS is not available and the vulnerability is not listed in KEV, its exploit probability cannot be quantified, yet the presence of an online exploit suggests a real threat to exposed devices.

Generated by OpenCVE AI on March 30, 2026 at 05:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to the latest Totolink firmware that removes the command injection in setLanCfg.
  • If no patch exists, block or disable /cgi-bin/cstecgi.cgi on the router via firewall rules or by restricting web‑GUI access to the local network only.
  • Further limit the administrative interface to trusted IP addresses or protect it behind a VPN.
  • Replace default administrative credentials with strong, unique passwords and enable the router’s firewall features to drop suspicious requests.
  • Monitor device logs for unexpected changes to the lanIp parameter or attempts to execute system commands.

Generated by OpenCVE AI on March 30, 2026 at 05:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 30 Mar 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-78
CPEs cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*
cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*

Mon, 30 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 30 Mar 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a3300r
Vendors & Products Totolink a3300r

Mon, 30 Mar 2026 03:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Title Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection
First Time appeared Totolink
Totolink a3300r Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:totolink:a3300r_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a3300r Firmware
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A3300r A3300r Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-30T14:52:01.775Z

Reserved: 2026-03-29T17:50:43.221Z

Link: CVE-2026-5101

cve-icon Vulnrichment

Updated: 2026-03-30T13:13:58.210Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-29T23:16:48.597

Modified: 2026-03-30T15:45:51.677

Link: CVE-2026-5101

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-30T07:59:09Z

Weaknesses