Is there a public PoC exploit available for CVE-2026-5103?

Yes, a public proof-of-concept exploit is available for CVE-2026-5103. Prioritise patching immediately. EPSS: 2.9%.

A3300R CVE-2026-5103

Q: What is the CVSS score of CVE-2026-5103?

CVE-2026-5103 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.9%.

EUVD-2026-17053 LOW

Command Injection (CWE-77)

2026-03-30 VulDB

GHSA-fxg3-w9hm-vf88

Command Injection TOTOLINK A3300R

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 15:42 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 01:45 euvd

EUVD-2026-17053

Analysis Generated

Mar 30, 2026 - 01:45 vuln.today

CVE Published

Mar 30, 2026 - 01:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. This issue affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument enable causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Remote command injection in Totolink A3300R firmware 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via the enable parameter in the setUPnPCfg function at /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and the vulnerability has a CVSS score of 6.3 with confirmed proof-of-concept demonstrated on GitHub.

Technical ContextAI

The vulnerability exists in the UPnP configuration handler (setUPnPCfg function) within the Totolink A3300R router's CGI interface. The weakness is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating that user-supplied input from the enable parameter is not properly sanitized before being passed to system command execution routines. The affected CGI script at /cgi-bin/cstecgi.cgi processes UPnP configuration requests; when the enable argument is manipulated, attacker-controlled shell metacharacters and command sequences bypass input validation and execute in the router's system context.

RemediationAI

Users should upgrade their Totolink A3300R firmware to the latest available release beyond 17.0.0cu.557_b20221024 as soon as available from Totolink. No specific patched version number has been independently confirmed in available data; therefore, users must visit https://www.totolink.net/ to check for firmware updates and apply the newest build. As a temporary mitigation pending firmware update, restrict access to the router's web management interface (typically port 80/443) to trusted networks only, disable remote management features if available, and ensure strong authentication credentials are in place to limit unauthorized access to CGI endpoints.