PT-2026-28759 · Totolink · A3300R

Lvhw · Published 2026-03-30 · Updated 2026-03-30 · CVE-2026-5105

NVD

CVSS v2.0

6.5

Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

A vulnerability was detected in Totolink A3300R 17.0.0cu.557 b20221024. The affected element is the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument pptpPassThru results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-5105

Affected Products

A3300R

References · 6

• 🔥 https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_pptpPassThru_cmd_inject · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5105 · Security Note
• https://vuldb.com/submit/779143 · Note
• https://vuldb.com/vuln/354130 · Note
• https://totolink.net · Note
• https://vuldb.com/vuln/354130/cti · Note