What is the CVSS score of CVE-2026-5177?

CVE-2026-5177 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.7%.

Is there a public PoC exploit available for CVE-2026-5177?

Yes, a public proof-of-concept exploit is available for CVE-2026-5177. Prioritise patching immediately. EPSS: 0.7%.

A3300R CVE-2026-5177

EUVD-2026-17281 LOW

Command Injection (CWE-77)

2026-03-31 VulDB

GHSA-mq3w-44cm-pfv8

Command Injection TOTOLINK A3300R

2.1

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-77 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Command injection prevention MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates network-accessible attack with low complexity but requiring low privileges (PR:L), reflecting an authenticated attack requirement. The presence of publicly available exploit code (E:P) significantly increases practical exploitation risk despite the moderate 6.3 base score. Real-world risk is elevated because: (1) the attack vector is network-based with low complexity, (2) authenticated access is required but may be achievable via default credentials or prior compromise, (3) public POC code removes the barrier to weaponization, and (4) impacts confidentiality, integrity, and availability equally. The combination of public POC availability, low attack complexity, and moderate impact (C:L/I:L/A:L) classifies this as a meaningful priority for organizations operating affected Totolik routers, particularly in environments where default or weak credentials are prevalent.
Exploit ScenarioDerived	An attacker with valid credentials to a Totolik A3300R router (obtained via default credentials, credential stuffing, or prior compromise) accesses the device's web interface and submits a crafted request to /cgi-bin/cstecgi.cgi with a malicious payload in the rxRate parameter containing shell command injection syntax such as backticks or semicolon-delimited commands. The unfiltered input is passed directly to a system command, allowing the attacker to execute arbitrary commands with the privileges of the web service, potentially establishing a reverse shell, exfiltrating configuration data, or modifying router settings. Public exploit code on GitHub demonstrates this attack chain, reducing the skill barrier for attackers.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 31, 2026

Command injection in Totolink A3300R 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via manipulation of the rxRate parameter in the setWiFiBasicCfg function at /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 with publicly available exploit code, making it a moderate-priority issue for affected device administrators despite requiring prior authentication.

RemediationAI

Totolink administrators should immediately apply the latest firmware update available for the A3300R device from https://www.totolink.net/. Until patching is possible, restrict access to the device's web management interface to trusted networks only, change any default or weak administrative credentials, and consider disabling remote access to the CGI endpoints if the functionality is not required. The presence of publicly available exploit code makes this vulnerability a priority for urgent patching. Users should verify the firmware version installed and cross-reference against Totolink's security bulletins to confirm whether their specific build is patched.

Affected VersionsENISA

A3300R 17.0.0cu.557_b20221024

Affected Packages

euvd a3300r no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the CGI endpoint /cgi-bin/cstecgi.cgi within Totolik A3300R firmware, specifically in the setWiFiBasicCfg function. The underlying issue is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating that user-supplied input from the rxRate parameter is not properly sanitized before being used in command construction or execution. This is a classic command injection vulnerability where an attacker can inject shell metacharacters or commands that are then executed with the privileges of the web service process. The affected component manages WiFi configuration settings on this consumer-grade router device.

Know when A3300R gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 06, 2026 - 15:22 vuln.today

Public exploit code

CVE Published

Mar 31, 2026 - 02:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this vulnerability is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument rxRate can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

Threat Intelligence Overview

EPSS Score

0.7%

Top 28% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.7%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.