Publicly Exploitable Command Injection Flaws Disclosed in Totolink A3300R Router
Vulnerability Disclosure · 9 sources · Updated 4mo ago · First seen Mar 30, 2026
Two high-severity command injection vulnerabilities have been disclosed in the Totolink A3300R router, both affecting firmware version 17.0.0cu.557_b20221024 and exposing the device to remote code execution through /cgi-bin/cstecgi.cgi. The flaws are tracked as CVE-2026-5104 and CVE-2026-5101. CVE-2026-5104 affects the setStaticRoute function, where manipulation of the ip argument can trigger command injection, while CVE-2026-5101 affects the setLanCfg function in the Parameter Handler component through the lanIp argument.
Public exploit material has been disclosed for both issues, according to VulDB and referenced advisory material, raising the risk of active abuse against exposed devices. NVD subsequently added initial analysis for the CVEs, assigning higher CVSS v3.1 severity assessments than the original CNA submissions and mapping the weaknesses to CWE-77, CWE-74, and CWE-78. The disclosures indicate that attackers could remotely inject operating system commands via crafted requests, making patching, exposure reduction, and monitoring of internet-facing Totolink A3300R systems urgent priorities.
