PT-2026-28757 · Totolink · Totolink A3300R

Lvhw · Published 2026-03-30 · Updated 2026-03-30 · CVE-2026-5103

Positive Technologies · (AI Summary)

CVSS v2.0

6.5

Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Totolink A3300R version 17.0.0cu.557 b20221024

Description A flaw exists in the Totolink A3300R device. The setUPnPCfg function within the /cgi-bin/cstecgi.cgi file is susceptible to command injection through manipulation of the enable argument. This allows for remote execution of commands. The exploit for this issue has been publicly released.

Recommendations Apply a software update that addresses the issue in the setUPnPCfg function of the /cgi-bin/cstecgi.cgi file.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-5103

Affected Products

Totolink A3300R

References · 7

• 🔥 https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_enable_cmd_inject · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5103 · Security Note
• https://vuldb.com/vuln/354128/cti · Note
• https://twitter.com/cybrsecpath/status/2038450641044230218 · Twitter Post
• https://totolink.net · Note
• https://vuldb.com/vuln/354128 · Note
• https://vuldb.com/submit/779140 · Note