CVE-2026-5101
Command Injection in Totolink A3300R Parameter Handler Enables Remote Exploit
Publication date: 2026-03-29
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a3300r_firmware | 17.0.0cu.557_b20221024 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Totolink A3300R router, specifically in version 17.0.0cu.557_b20221024. It affects the function setLanCfg within the /cgi-bin/cstecgi.cgi file, which is part of the Parameter Handler component. The issue arises from improper handling of the lanIp argument, allowing an attacker to perform command injection.
Because the vulnerability allows command injection, an attacker can remotely execute arbitrary commands on the affected device. The exploit is publicly available, making it easier for attackers to leverage this vulnerability.
How can this vulnerability impact me? :
This vulnerability can allow a remote attacker to execute arbitrary commands on the affected Totolink A3300R device without user interaction. This could lead to unauthorized control over the device, potentially compromising network security, disrupting network services, or enabling further attacks within the network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests sent to the endpoint /cgi-bin/cstecgi.cgi that contain the lanIp parameter with unusual or command-like values.
A practical detection method is to capture network traffic and look for POST requests with JSON payloads where the lanIp parameter includes shell commands or suspicious strings such as backticks or command execution patterns.
For example, using a tool like curl or wget, you can simulate or detect such requests. To detect on the device or network, you might use commands like:
- tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
- grep or jq on captured HTTP POST payloads to find occurrences of lanIp parameters containing suspicious command injection patterns such as backticks (`), semicolons (;), or shell commands like wget.
Additionally, reviewing web server logs for POST requests to /cgi-bin/cstecgi.cgi with lanIp parameters containing unexpected values can help identify exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint /cgi-bin/cstecgi.cgi to trusted networks only, such as by firewall rules or network segmentation.
Disabling remote management or access to the affected router firmware version 17.0.0cu.557_b20221024 can reduce exposure.
If possible, update the router firmware to a version where this vulnerability is patched.
Monitor network traffic and logs for signs of exploitation attempts and block suspicious IP addresses.
As a temporary workaround, implement input validation or filtering on the lanIp parameter if you have control over the device configuration or proxy in front of the device.