Command Injection Vulnerability in Totolink A3300R Router
CVE-2026-5102
Key Information:
Badges
What is CVE-2026-5102?
A command injection vulnerability has been identified in the Totolink A3300R router, specifically in the setSmartQosCfg function within the /cgi-bin/cstecgi.cgi component. This flaw stems from improper handling of the qos_up_bw parameter, which can be manipulated by an attacker. The nature of this vulnerability allows for remote exploitation, posing significant risks as malicious users could execute arbitrary commands on the vulnerable device. The exploit for this vulnerability has been made publicly available, increasing the urgency for affected users to apply necessary security measures.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
A3300R 17.0.0cu.557_b20221024
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved