PT-2026-29188 · Totolink · A3300R

Lvhw · Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-5178

NVD

CVSS v2.0

6.5

Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557 b20221024. Affected by this issue is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument vlanPriLan3 leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-5178

Affected Products

A3300R

References · 7

• 🔥 https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_vlanPriLan3_cmd_inject · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5178 · Security Note
• https://vuldb.com/vuln/354246 · Note
• https://twitter.com/cyberbivash/status/2038850617708359802 · Twitter Post
• https://totolink.net · Note
• https://vuldb.com/vuln/354246/cti · Note
• https://vuldb.com/submit/779147 · Note