CVE-2026-5101

CWE-74CWE-77 — Command InjectionCWE-78 — OS Command Injection3 documents3 sources
Severity
5.3MEDIUM
EPSS
2.9%
top 13.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink A3300rTotolink A3300r Firmware
Timeline
PublishedMar 29
Latest updateMar 30

Description

A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5totolink/a3300r17.0.0cu.557_b20221024
▶NVDtotolink/a3300r_firmware17.0.0cu.557_b20221024

🔴Vulnerability Details

2
GHSA
GHSA-452m-gc7f-x9g5: A vulnerability was identified in Totolink A3300R 17↗2026-03-30
▶
CVEList
Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection↗2026-03-29
▶
CVE-2026-5101 (MEDIUM CVSS 5.3) | A vulnerability was identified in T | cvebase.io