Description
A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_B20221024. The impacted element is the function vsetTr069Cfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument stun_pass leads to os command injection. The exploit has been disclosed publicly and may be used.
Published: 2026-04-06
Score: 5.1 Medium
EPSS: 1.7% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the vsetTr069Cfg function within the /cgi-bin/cstecgi.cgi script of Totolink A3300R firmware 17.0.0cu.557_B20221024. An attacker can manipulate the stun_pass argument, causing an operating‑system command injection that falls under CWE-77 and CWE-78. Successful exploitation leads to arbitrary OS command execution and full control over the device.

Affected Systems

The vulnerability affects the Totolink A3300R router running firmware version 17.0.0cu.557_B20221024. The exposed CGI endpoint is named /cgi-bin/cstecgi.cgi and is specific to this router model.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. The EPSS score of about 1.7% (0.01744) and absence from the CISA KEV catalog suggest limited current exploitation. The risk escalates if the CGI endpoint is externally reachable; no explicit authentication requirements are stated, so it is inferred that an attacker with network access to the script could exploit the weakness without additional credentials.

Generated by OpenCVE AI on June 17, 2026 at 12:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware release that patches the command‑injection flaw in the vsetTr069Cfg endpoint.
  • If a firmware update is unavailable, block or remove external access to the /cgi-bin/cstecgi.cgi script and disable remote STUN configuration management.
  • Restrict remote management to trusted internal IP ranges or enforce VPN access only.
  • Use input validation to sanitize stun_pass values, preventing arbitrary command injection.

Generated by OpenCVE AI on June 17, 2026 at 12:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Apr 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Apr 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a3300r
Vendors & Products Totolink a3300r

Mon, 06 Apr 2026 20:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_B20221024. The impacted element is the function vsetTr069Cfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument stun_pass leads to os command injection. The exploit has been disclosed publicly and may be used.
Title Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection
First Time appeared Totolink
Totolink a3300r Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a3300r_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a3300r Firmware
References
Metrics cvssV2_0

{'score': 5.2, 'vector': 'AV:A/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.5, 'vector': 'CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A3300r A3300r Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-07T15:10:20.818Z

Reserved: 2026-04-06T09:45:14.836Z

Link: CVE-2026-5679

cve-icon Vulnrichment

Updated: 2026-04-07T15:06:18.706Z

cve-icon NVD

Status : Deferred

Published: 2026-04-06T20:16:28.787

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-5679

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-17T12:45:07Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')