CVE-2026-5177
Published: 31 March 2026
Description
A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this vulnerability is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument rxRate can lead to command injection. The attack may be launched remotely. The…
more
exploit has been made available to the public and could be used for attacks.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the command injection flaw in the Totolink A3300R firmware by identifying, reporting, and applying patches to the vulnerable setWiFiBasicCfg function.
Requires validation of the rxRate argument to ensure it contains only expected content, preventing command injection in the cgi-bin/cstecgi.cgi script.
Restricts the rxRate input parameter to authorized formats and values such as numeric rates only, blocking injection payloads.
Security SummaryAI
CVE-2026-5177 is a command injection vulnerability affecting the Totolink A3300R router running firmware version 17.0.0cu.557_b20221024. The flaw resides in the setWiFiBasicCfg function within the /cgi-bin/cstecgi.cgi script, where manipulation of the rxRate argument enables attackers to inject arbitrary commands. This issue is classified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-77 (Command Injection), with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by authenticated users with low privileges, such as standard administrative access to the router's web interface. Successful exploitation allows limited impacts, including partial compromise of confidentiality, integrity, and availability on the targeted device, potentially enabling further network reconnaissance or pivoting within the local environment.
Advisories and references, including those from VulDB (vuln/354245) and a public GitHub repository (LvHongW/Vuln-of-totolink_A3300R), detail the vulnerability and provide a proof-of-concept exploit for the rxRate command injection. The Totolink vendor website (totolink.net) is referenced for potential firmware updates or mitigation guidance, though no specific patches are detailed in the available sources.
A publicly available exploit on GitHub heightens the risk of real-world attacks against unpatched Totolink A3300R devices.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via authenticated web interface on public-facing router directly enables T1190 (Exploit Public-Facing Application) and T1059.004 (Unix Shell) execution.