A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. This issue affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument enable causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
References
| Link | Resource |
|---|---|
| https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_enable_cmd_inject | Exploit Third Party Advisory |
| https://vuldb.com/submit/779140 | Permissions Required VDB Entry |
| https://vuldb.com/vuln/354128 | Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/354128/cti | Third Party Advisory VDB Entry |
| https://www.totolink.net/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
30 Mar 2026, 15:42
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Totolink
Totolink a3300r Totolink a3300r Firmware |
|
| CPE | cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:* cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:* |
|
| References | () https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_enable_cmd_inject - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/submit/779140 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/vuln/354128 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/354128/cti - Third Party Advisory, VDB Entry | |
| References | () https://www.totolink.net/ - Product |
Information
Published : 2026-03-30 02:16
Updated : 2026-03-30 15:42
NVD link : CVE-2026-5103
Mitre link : CVE-2026-5103
CVE.ORG link : CVE-2026-5103
JSON object : View
Products Affected
totolink
- a3300r
- a3300r_firmware