What is the CVSS score of CVE-2026-5101?

CVE-2026-5101 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 2.9%.

Is there a public PoC exploit available for CVE-2026-5101?

Yes, a public proof-of-concept exploit is available for CVE-2026-5101. Prioritise patching immediately. EPSS: 2.9%.

A3300R CVE-2026-5101

EUVD-2026-17048 LOW

Command Injection (CWE-77)

2026-03-29 VulDB

Command Injection TOTOLINK A3300R

2.1

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-77 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Command injection prevention MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS v4.0 vector indicates Network attack vector with Low complexity and Low privileges required (PR:L), meaning an authenticated user with standard router access can exploit this remotely without user interaction. The E:P (Exploit Maturity: Proof-of-Concept) designation combined with publicly available exploit code elevates real-world risk despite the moderate 5.3 base score. The Low impact rating (VC:L, VI:L, VA:L) suggests limited direct confidentiality, integrity, and availability impact from a single execution, yet command injection in a router's administrative interface poses serious secondary risks-attackers with authenticated access can escalate privileges, modify network configurations, install persistence mechanisms, or pivot to internal network segments. From an SSVC perspective, exploitation is proven (POC public), automatable via the CGI interface, and the technical impact is substantial for a network device. This is a priority vulnerability for any organization operating Totolink A3300R routers, particularly in edge network positions.
Exploit ScenarioDerived	An attacker who has obtained valid administrative credentials for the Totolink A3300R router (through credential stuffing, weak default passwords, or phishing) can access the web interface and craft a request to /cgi-bin/cstecgi.cgi with a malicious lanIp parameter containing shell commands such as `127.0.0.1; cat /etc/passwd` or similar payloads. The setLanCfg function processes this input without proper sanitization and executes the injected commands with router system privileges, allowing the attacker to exfiltrate sensitive configuration data, modify firewall rules, or establish persistent backdoors on the device. Publicly available exploit code from GitHub simplifies the attack, reducing the skill barrier for exploitation.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 2.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 29, 2026

Command injection in Totolink A3300R firmware versions up to 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via the lanIp parameter in the setLanCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists for this vulnerability. With a CVSS score of 5.3 and moderate real-world exploitability, this presents a meaningful risk to affected router installations.

RemediationAI

Users should immediately check the Totolink website (https://www.totolink.net/) for an available firmware update addressing CVE-2026-5101 and upgrade to a patched version if available. As an interim workaround pending patch availability, restrict access to the router's web administrative interface (/cgi-bin/cstecgi.cgi) to trusted IP addresses only via firewall rules or disable remote management if not required. Additionally, change default or weak administrative credentials to prevent unauthorized access to the parameter handler. If patch availability cannot be confirmed from the vendor, consider replacing the device with an alternative router or implementing network segmentation to limit the impact of potential command injection exploitation.

Affected VersionsENISA

A3300R 17.0.0cu.557_b20221024

Affected Packages

euvd a3300r no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the Parameter Handler component of the Totolink A3300R router firmware, specifically in the setLanCfg function accessible via the web-based CGI interface at /cgi-bin/cstecgi.cgi. The lanIp parameter is improperly validated before being processed, allowing injection of shell metacharacters that are executed by the underlying system command interpreter. This is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), a command injection flaw stemming from insufficient input sanitization in a network device's administrative interface. The affected product is identified by CPE cpe:2.3:a:totolink:a3300r and specifically version 17.0.0cu.557_b20221024.

Know when A3300R gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 15:45 vuln.today

Public exploit code

CVE Published

Mar 29, 2026 - 23:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Threat Intelligence Overview

EPSS Score

2.9%

Top 14% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 2.9%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.