CVE-2026-5105

MEDIUM

Published:Mar 30, 2026(Today)

Modified:Mar 30, 2026

Vulnerability Description

A vulnerability was detected in Totolink A3300R 17.0.0cu.557_b20221024. The affected element is the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument pptpPassThru results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Attack Characteristics

Network AccessLow ComplexityLow PrivilegesNo User Interaction

🤖

AI analysis not yet available

Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.

References

https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_pp...
https://vuldb.com/submit/779143
https://vuldb.com/vuln/354130
https://vuldb.com/vuln/354130/cti

CVSS Score

v3.1

6.3/ 10.0

MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

At a Glance

Affected Products

References

CVSS v3 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVE-2026-5105

✦ Vulnerability Description

Attack Characteristics

References

CVSS Score

At a Glance

CVSS v3 Vector

Impact Analysis

Vulnerability Description