CVE-2026-5102
Published: 30 March 2026
Description
A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. This vulnerability affects the function setSmartQosCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument qos_up_bw results in command injection. The attack can be executed…
more
remotely. The exploit has been released to the public and may be used for attacks.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation and sanitization of untrusted inputs like the qos_up_bw parameter to prevent command injection in the setSmartQosCfg function.
SI-2 mandates timely flaw remediation through firmware updates to eliminate the command injection vulnerability in Totolink A3300R.
AC-6 enforces least privilege on the Parameter Handler process to limit the scope and impact of arbitrary commands executed via injection.
Security SummaryAI
CVE-2026-5102 is a command injection vulnerability in the Totolink A3300R router running firmware version 17.0.0cu.557_b20221024. The flaw resides in the setSmartQosCfg function within the /cgi-bin/cstecgi.cgi file of the Parameter Handler component, where manipulation of the qos_up_bw argument enables arbitrary command execution. It is classified under CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection), with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by attackers who possess low privileges, such as authenticated users on the device. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling attackers to execute arbitrary commands on the underlying system without requiring user interaction.
References include a public exploit published on GitHub at https://github.com/Litengzheng/vul_db/blob/main/A3300R/vul_40/README.md, along with VulDB entries detailing the issue (https://vuldb.com/vuln/354127 and related pages). Security practitioners should consult the vendor's site at https://www.totolink.net/ for any available patches or firmware updates, as the exploit's public release increases the risk of active attacks.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in router's web CGI enables exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).