CVE-2026-5176
Remote Command Injection in Totolink A3300R setSyslogCfg Function
Publication date: 2026-03-31
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a3300r_firmware | 17.0.0cu.557_b20221024 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5176 is a command injection vulnerability in the TOTOLINK A3300R router, version 17.0.0cu.557_b20221024. It exists in the function setSyslogCfg within the /cgi-bin/cstecgi.cgi file. An attacker can manipulate the "rtLogServer" parameter in a crafted HTTP POST request to execute arbitrary operating system commands remotely on the device.
The vulnerability arises because the user-supplied "rtLogServer" parameter is passed to a function that inserts it into a buffer and then executes it as a system command without proper sanitization, allowing command injection.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary commands on the affected router, potentially leading to full compromise of the device.
- Attackers can gain unauthorized control over the router.
- They may manipulate network traffic or disrupt network services.
- Sensitive information stored or passing through the router could be exposed.
- The device could be used as a foothold for further attacks within the network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests sent to the endpoint /cgi-bin/cstecgi.cgi that include the parameter "rtLogServer" with unusual or command-like values.
A detection method involves capturing and inspecting network traffic for POST requests with JSON bodies containing "topicurl" set to "setSyslogCfg" and "rtLogServer" containing suspicious commands such as wget or other shell commands.
Example commands to detect exploitation attempts include using network packet capture tools like tcpdump or tshark to filter such requests:
- tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'rtLogServer'
- tshark -Y 'http.request.method == "POST" && http.request.uri contains "/cgi-bin/cstecgi.cgi" && frame contains "rtLogServer"' -T fields -e http.file_data
Additionally, checking router logs for unexpected command execution or unusual system behavior may help identify exploitation.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable router's management interface to trusted networks only, such as internal LAN or VPN.
Disabling remote management or the affected function setSyslogCfg if possible can reduce exposure.
Applying any available firmware updates or patches from the vendor that address this command injection vulnerability is critical.
Monitoring network traffic for exploitation attempts and blocking suspicious requests targeting /cgi-bin/cstecgi.cgi with the rtLogServer parameter can help prevent attacks.
If no patch is available, consider isolating the device from untrusted networks until a fix is applied.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-5176 vulnerability allows remote attackers to execute arbitrary commands on the TOTOLINK A3300R router, potentially compromising the device. Such unauthorized access and control over network infrastructure can lead to data breaches or unauthorized data manipulation.
This kind of security flaw can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require the protection of personal and sensitive data through adequate security measures. A compromised router could be used as an entry point for attackers to access or exfiltrate protected data, thus violating these regulations.