Cyber Posture

CVE-2026-5102

MediumPublic PoC

Published: 30 March 2026

Published
30 March 2026
Modified
30 March 2026
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0267 85.9th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. This vulnerability affects the function setSmartQosCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument qos_up_bw results in command injection. The attack can be executed…

more

remotely. The exploit has been released to the public and may be used for attacks.

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 requires validation and sanitization of untrusted inputs like the qos_up_bw parameter to prevent command injection in the setSmartQosCfg function.

prevent

SI-2 mandates timely flaw remediation through firmware updates to eliminate the command injection vulnerability in Totolink A3300R.

prevent

AC-6 enforces least privilege on the Parameter Handler process to limit the scope and impact of arbitrary commands executed via injection.

Security SummaryAI

CVE-2026-5102 is a command injection vulnerability in the Totolink A3300R router running firmware version 17.0.0cu.557_b20221024. The flaw resides in the setSmartQosCfg function within the /cgi-bin/cstecgi.cgi file of the Parameter Handler component, where manipulation of the qos_up_bw argument enables arbitrary command execution. It is classified under CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection), with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

The vulnerability can be exploited remotely by attackers who possess low privileges, such as authenticated users on the device. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling attackers to execute arbitrary commands on the underlying system without requiring user interaction.

References include a public exploit published on GitHub at https://github.com/Litengzheng/vul_db/blob/main/A3300R/vul_40/README.md, along with VulDB entries detailing the issue (https://vuldb.com/vuln/354127 and related pages). Security practitioners should consult the vendor's site at https://www.totolink.net/ for any available patches or firmware updates, as the exploit's public release increases the risk of active attacks.

Details

CWE(s)

Affected Products

totolink
a3300r firmware
17.0.0cu.557_b20221024

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Command injection in router's web CGI enables exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References