EUVD-2026-17053
GHSA-fxg3-w9hm-vf88
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 6.3 (Medium) rating reflects attack vector of network-accessible, low attack complexity, and authentication requirement (PR:L), with impact limited to confidentiality, integrity, and availability at system level. However, the EPSS exploitation factor (E:P) indicates proof-of-concept availability correlates with elevated real-world exploitation probability. The combination of public exploit code availability, low attack complexity (AC:L), and the router's typical internet-facing deployment increases practical risk beyond the baseline CVSS score. Remediation should be prioritized for internet-exposed Totolink A3300R devices, though the authentication requirement (PR:L) limits exposure to users with valid router credentials or those able to bypass authentication. The SSVC decision framework would classify this as significant: exploitation is confirmed possible (POC public), technical impact is high (command execution), and the product type (network appliance) suggests broad deployment. |
| Exploit ScenarioDerived | An authenticated attacker (or one who has obtained valid router credentials through phishing or default password exploitation) sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with a malicious command injected into the enable parameter-for example, enable=1;id; or enable=1$(whoami)-which executes arbitrary shell commands on the router with the privileges of the web server process. Public exploit code published on GitHub demonstrates this attack against the A3300R specifically, making the attack feasible for actors with basic networking knowledge. The resulting command execution could allow an attacker to extract router configuration, modify firewall rules, pivot to the local network, or establish persistence on the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 30, 2026
Remote command injection in Totolink A3300R firmware 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via the enable parameter in the setUPnPCfg function at /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and the vulnerability has a CVSS score of 6.3 with confirmed proof-of-concept demonstrated on GitHub.
RemediationAI
Users should upgrade their Totolink A3300R firmware to the latest available release beyond 17.0.0cu.557_b20221024 as soon as available from Totolink. No specific patched version number has been independently confirmed in available data; therefore, users must visit https://www.totolink.net/ to check for firmware updates and apply the newest build. As a temporary mitigation pending firmware update, restrict access to the router's web management interface (typically port 80/443) to trusted networks only, disable remote management features if available, and ensure strong authentication credentials are in place to limit unauthorized access to CGI endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the UPnP configuration handler (setUPnPCfg function) within the Totolink A3300R router's CGI interface. The weakness is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating that user-supplied input from the enable parameter is not properly sanitized before being passed to system command execution routines. The affected CGI script at /cgi-bin/cstecgi.cgi processes UPnP configuration requests; when the enable argument is manipulated, attacker-controlled shell metacharacters and command sequences bypass input validation and execute in the router's system context.
Know when A3300R gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. This issue affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument enable causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A3300R Parameter Handling Flaws
View all 4Command injection in Totolink A3300R router firmware 17.0.0cu.557_b20221024 allows unauthenticated remote attackers to e
Command injection in Totolink A3300R firmware versions up to 17.0.0cu.557_b20221024 allows authenticated remote attacker
Command injection in Totolink A3300R firmware 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute ar
Command injection in Totolink A3300R 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary c
OS command injection in Totolink A3300R firmware version 17.0.0cu.557_B20221024 allows authenticated local attackers to
Exploit-DB