Login Request a demo
Critical severity · published Mar 31, 2026
CVE-2026-5176
Totolink A3300R cstecgi.cgi setSyslogCfg command injection
9.8
CVSS
2.2%
EPSS
No
On KEV
Description
A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. Affected is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument provided results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A3
A3300R · Totolink
17.0.0cu.557_b20221024 · source: vendor
AF
A3300r Firmware · Totolink
17.0.0cu.557_b20221024 · source: NVD
Affected product
A3
A3300R
Totolink
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5176
Exploit
https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_rtLogServer_cmd_inject
Third Party Advisory
https://vuldb.com/submit/779145
Third Party Advisory
https://vuldb.com/vuln/354244
Permissions Required
https://vuldb.com/vuln/354244/cti
Product
https://www.totolink.net/
More from A3300R
9.8
CVE-2026-31178
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to /cgi-bin/cstecgi.cgi
9.8
CVE-2026-31181
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to…
9.8
CVE-2026-31175
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunEnable parameter to /cgi-bin/cstecgi.cgi
9.8
CVE-2026-31177
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi
9.8
CVE-2026-31170
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun-pass parameter to /cgi-bin/cstecgi.cgi