Is there a public PoC exploit available for CVE-2026-5105?

Yes, a public proof-of-concept exploit is available for CVE-2026-5105. Prioritise patching immediately. EPSS: 2.9%.

A3300R CVE-2026-5105

Q: What is the CVSS score of CVE-2026-5105?

CVE-2026-5105 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.9%.

EUVD-2026-17056 LOW

Command Injection (CWE-77)

2026-03-30 VulDB

GHSA-3h9m-4hx4-r4rj

Command Injection A3300R

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 15:40 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 03:45 euvd

EUVD-2026-17056

Analysis Generated

Mar 30, 2026 - 03:45 vuln.today

CVE Published

Mar 30, 2026 - 03:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was detected in Totolink A3300R 17.0.0cu.557_b20221024. The affected element is the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument pptpPassThru results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

AnalysisAI

Command injection in Totolink A3300R firmware version 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via manipulation of the pptpPassThru parameter in the setVpnPassCfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (medium severity) with network-accessible attack vector and low complexity; publicly available exploit code exists, making this an actionable threat for affected deployments.

Technical ContextAI

The vulnerability exists in the Parameter Handler component of Totolik A3300R router firmware, specifically within the CGI script cstecgi.cgi. The setVpnPassCfg function fails to properly sanitize the pptpPassThru parameter before passing it to system command execution, allowing injection of shell metacharacters. This is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), a command injection flaw in a CGI-based parameter processing routine. The attack targets the VPN configuration functionality, suggesting the vulnerable code path processes user-controlled input through shell invocation without adequate escaping or validation.

RemediationAI

Immediately upgrade the Totolik A3300R firmware to the patched version released by the vendor. Patch availability and the specific fixed firmware version have not been independently confirmed from the provided references; however, users should visit https://www.totolik.net/ and check for firmware updates available for the A3300R model. Until a patch can be applied, restrict administrative access to the device by enforcing strong authentication credentials, disabling remote management interfaces if not required, and limiting access to the web management interface to trusted IP addresses only. Ensure the device is not exposed to untrusted networks without additional protective controls (e.g., VPN, firewall rules).