A3300R CVE-2026-5178

While the CVSS score of 6.3 indicates medium severity, multiple exploitation signals elevate real-world risk. The CVSS vector reveals AV:N (network-accessible) and AC:L (low complexity) attack conditions, but requires PR:L (low privilege authentication), constraining the threat to users with valid credentials or attackers who have obtained initial network access. The explicit EPSS P/E tag (indicating proof-of-concept or exploitation evidence) combined with publicly available exploit code on GitHub significantly increases practical exploitability probability. However, the PR:L requirement limits impact scope to authenticated scenarios-typically network administrators or compromised user accounts on the LAN. The CVSS impact metrics (C:L/I:L/A:L) reflect confidentiality, integrity, and availability impacts limited to the affected system rather than critical infrastructure compromise. This should be prioritized for organizations operating Totolink A3300R routers in production environments, particularly where router admin credentials are insufficiently controlled or where untrusted internal users have network access.

An authenticated attacker on the LAN (or an attacker who has compromised a legitimate user's credentials) accesses the router's web interface and sends a malicious HTTP request to /cgi-bin/cstecgi.cgi with the setIptvCfg function, injecting shell metacharacters into the vlanPriLan3 parameter (e.g., vlanPriLan3=value;malicious_command;). Due to insufficient input sanitization in the CGI script, the injected command executes with the privileges of the web server process, allowing the attacker to read configuration files, modify firewall rules, establish reverse shells, or compromise downstream devices on the network. Publicly available exploit code from GitHub (https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_vlanPriLan3_cmd_inject) demonstrates the practical feasibility of this attack.