What is the CVSS score of CVE-2026-5102?

CVE-2026-5102 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 2.9%.

Is there a public PoC exploit available for CVE-2026-5102?

Yes, a public proof-of-concept exploit is available for CVE-2026-5102. Prioritise patching immediately. EPSS: 2.9%.

A3300R CVE-2026-5102

EUVD-2026-17050 LOW

Command Injection (CWE-77)

2026-03-30 VulDB

GHSA-h2wr-p8mq-wj29

Command Injection TOTOLINK A3300R

2.1

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-77 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Command injection prevention MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) indicates network-accessible attack with low complexity requiring authenticated privileges but no user interaction. The medium CVSS score of 6.3 reflects limited scope (single system impact) and partial confidentiality/integrity/availability compromise. However, the presence of publicly available exploit code significantly increases practical risk despite the authentication requirement. The PR:L (authenticated) requirement does not substantially mitigate risk in home/small-business router environments where default credentials are often unchanged or shared among trusted users. The E:P (exploit proof-of-concept) rating in the CVSS vector confirms POC availability. Real-world risk is elevated because routers are persistent, always-on targets with potential for lateral network movement after compromise, making this a practical priority for affected deployments despite the 'medium' CVSS label.
Exploit ScenarioDerived	An authenticated user on the same network or with network access to the router's web interface (e.g., a user with default credentials not changed by the administrator) could craft a malicious HTTP request to /cgi-bin/cstecgi.cgi with a shell command embedded in the qos_up_bw parameter, such as 'qos_up_bw=$(malicious_command)' or similar command injection payload. The setSmartQosCfg function would then execute the injected command with the privileges of the CGI process, potentially allowing the attacker to modify router configuration, exfiltrate network traffic logs, or pivot to other network-connected devices. Publicly available exploit code on GitHub (referenced in VulDB submission) lowers the barrier for non-expert attackers.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 2.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 30, 2026

Command injection in Totolink A3300R 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary system commands via the qos_up_bw parameter in the setSmartQosCfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (medium severity) with low attack complexity, and publicly available exploit code exists, though no active exploitation via CISA KEV has been confirmed at time of analysis.

RemediationAI

Users should immediately contact Totolink for patched firmware versions, as no specific vendor-released patch version is referenced in available data. In the interim, restrict network access to the router's management interface (typically port 80/443) to trusted IP addresses only, change default administrative credentials if not already done, and consider disabling remote management features if not required. Firmware updates, when available, should be obtained exclusively from Totolink's official website at https://www.totolink.net/. Organizations managing multiple A3300R units should prioritize patching and credential rotation, as the low attack complexity and public POC availability create elevated attack probability for networked environments.

Affected VersionsENISA

A3300R 17.0.0cu.557_b20221024

Affected Packages

euvd a3300r no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the Parameter Handler component of Totolink's web-based management interface (cstecgi.cgi), specifically in the setSmartQosCfg function which handles Quality of Service bandwidth configuration. The root cause is improper input validation of the qos_up_bw parameter, classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), allowing an attacker to inject shell metacharacters or command separators. The affected device is the Totolink A3300R wireless router, a consumer-grade networking device that exposes this CGI endpoint via HTTP/HTTPS without sufficient input sanitization.

Know when A3300R gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 15:49 vuln.today

Public exploit code

CVE Published

Mar 30, 2026 - 00:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. This vulnerability affects the function setSmartQosCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument qos_up_bw results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Threat Intelligence Overview

EPSS Score

2.9%

Top 14% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 2.9%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.