Vulnerability · Published Mar 30, 2026 · Assigned by VulDB
CVE-2026-5103Totolink A3300R cstecgi.cgi setUPnPCfg command injection
Medium 6.3
In plain English
A medium-severity command injection in A3300R from Totolink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)4.1%top 9.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. This issue affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument enable causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Affected products (as reported)
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-354128 | Totolink A3300R cstecgi.cgi setUPnPCfg command injection vdb-entry, technical-description
- VDB-354128 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #779140 | Totolink A3300R 17.0.0cu.557_b20221024 Command Injection third-party-advisory
- https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_enable_cmd_inject exploit
- https://www.totolink.net/ product