Loading vulnerability…
Command Injection in Totolink A3300R setStaticRoute
CVE-2026-5104 is a remote command injection vulnerability affecting Totolink A3300R firmware version 17.0.0cu.557_b20221024. The flaw is in the setStaticRoute function exposed through /cgi-bin/cstecgi.cgi, where insufficient neutralization of attacker-controlled input in the ip argument allows crafted input to be interpreted as operating system commands. Public reporting indicates the issue is reachable remotely and that exploit details have been publicly disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker to execute arbitrary commands on the affected device in the context of the vulnerable web management component. This can result in compromise of the router, including unauthorized modification of configuration, disruption of network services, interception or manipulation of traffic, and potential use of the device as a foothold for further activity. Public scoring references indicate impacts to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
Restrict access to the router management interface and /cgi-bin/cstecgi.cgi to trusted administrative networks only. Disable remote administration from untrusted networks, place the management plane behind firewall or ACL controls, and avoid exposing the device web interface to the Internet. Monitor for suspicious requests targeting setStaticRoute or containing shell metacharacters in the ip parameter. Where feasible, segment affected devices and replace or isolate unpatched systems until a fix is available.
Patch, then assume compromise.
Upgrade Totolink A3300R firmware to a vendor-fixed version if one is available. If no patched release is currently available, Totolink should correct the setStaticRoute implementation in /cgi-bin/cstecgi.cgi by eliminating shell invocation for user-controlled data, strictly validating and canonicalizing the ip parameter against expected IP address syntax, and using safe APIs that do not pass unsanitized input to command interpreters. After patching, verify the exposed CGI endpoint cannot be abused with metacharacters or command separators.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.