PT-2026-28757 · Totolink · Totolink A3300R

Lvhw · Publicado 2026-03-30 · Atualizado 2026-03-30 · CVE-2026-5103

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink A3300R version 17.0.0cu.557 b20221024

Description A flaw exists in the Totolink A3300R device. The setUPnPCfg function within the /cgi-bin/cstecgi.cgi file is susceptible to command injection through manipulation of the enable argument. This allows for remote execution of commands. The exploit for this issue has been publicly released.

Recommendations Apply a software update that addresses the issue in the setUPnPCfg function of the /cgi-bin/cstecgi.cgi file.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

CVE-2026-5103

Produtos afetados

Totolink A3300R

Referências · 9

• 🔥 https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_enable_cmd_inject · Exploit
• https://twitter.com/CVEarity/status/2038604291452346808 · Publicação no Twitter
• https://vuldb.com/vuln/354128 · Nota
• https://vuldb.com/vuln/354128/cti · Nota
• https://twitter.com/CVEnew/status/2038516971646648527 · Publicação no Twitter
• https://vuldb.com/submit/779140 · Nota
• https://twitter.com/cybrsecpath/status/2038450641044230218 · Publicação no Twitter
• https://totolink.net · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-5103 · Nota de Segurança