CVE-2026-5104

moderate-risk
Published 2026-03-30

A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_b20221024. Impacted is the function setStaticRoute of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument ip leads to command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

Do I need to act?

~
2.2% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Totolink

References (5)

Exploit https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_ip_cmd_injec...
Permissions Required https://vuldb.com/submit/779142
Third Party Advisory https://vuldb.com/vuln/354129
Third Party Advisory https://vuldb.com/vuln/354129/cti
Product https://www.totolink.net/
33
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 5/34 · Minimal
Exposure 5/34 · Minimal