Description
A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. This issue affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument enable causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-03-30
Score: 5.3 Medium
EPSS: 2.9% Low
KEV: No
Impact: Remote Command Execution
Action: Apply Patch
AI Analysis

Impact

A flaw in the setUPnPCfg function within /cgi-bin/cstecgi.cgi allows an attacker to inject shell commands through the enable parameter. This permits execution of arbitrary commands on the device, potentially compromising confidentiality, integrity, and availability. The weakness is related to improper handling of user input and command construction, identified as CWE‑74 and CWE‑77.

Affected Systems

The vulnerability affects the Totolink A3300R router running firmware version 17.0.0cu.557_b20221024. Users of this specific firmware are at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, and the public availability of an exploit increases the likelihood of exploitation. While no EPSS score is available and it is not listed in the KEV catalog, the attack vector is remote and does not require local access. An attacker with network reach to the device can send a crafted request to trigger command execution.

Generated by OpenCVE AI on March 30, 2026 at 05:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the router firmware to a version that removes the vulnerable setUPnPCfg function.
  • If a firmware update is unavailable, disable the UPnP feature or block web access to /cgi-bin/cstecgi.cgi.
  • Configure network firewalls to restrict remote management access to the router.
  • Regularly review router logs for suspicious cgi requests and consider enabling logging of command execution attempts.

Generated by OpenCVE AI on March 30, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 30 Mar 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*
cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*

Mon, 30 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 30 Mar 2026 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a3300r
Vendors & Products Totolink a3300r

Mon, 30 Mar 2026 03:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. This issue affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument enable causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Title Totolink A3300R cstecgi.cgi setUPnPCfg command injection
First Time appeared Totolink
Totolink a3300r Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:totolink:a3300r_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a3300r Firmware
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A3300r A3300r Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-30T11:26:52.093Z

Reserved: 2026-03-29T17:50:50.164Z

Link: CVE-2026-5103

cve-icon Vulnrichment

Updated: 2026-03-30T11:25:10.179Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-30T02:16:15.840

Modified: 2026-03-30T15:42:30.710

Link: CVE-2026-5103

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-30T07:03:46Z

Weaknesses