What is the CVSS score of EUVD-2026-17056?

EUVD-2026-17056 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 2.9%.

Is there a public PoC exploit available for EUVD-2026-17056?

Yes, a public proof-of-concept exploit is available for EUVD-2026-17056. Prioritise patching immediately. EPSS: 2.9%.

A3300R EUVD-2026-17056

| CVE-2026-5105 LOW

Command Injection (CWE-77)

2026-03-30 VulDB

GHSA-3h9m-4hx4-r4rj

Command Injection TOTOLINK A3300R

2.1

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-77 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Command injection prevention MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	This vulnerability presents moderate real-world risk based on converging signals. The CVSS score of 6.3 reflects network-accessible attack vector (AV:N) and low attack complexity (AC:L), but requires authenticated access (PR:L), which limits exposure to users with valid credentials on the device. The EPSS metric is not provided, but the E:P flag in the CVSS vector indicates proof-of-concept code exists publicly, increasing practical exploitability. Critically, publicly available exploit code on GitHub lowers the barrier to weaponization for attackers with basic shell scripting knowledge. The CVSS Reliability (RC:R) is rated as Reasonable, suggesting vulnerability details are confirmed. For router appliances, authenticated access often equates to local admin or compromised user account, but given typical home router usage patterns where default credentials are common or unchanged, the authenticated-only constraint provides limited real protection. This is a priority issue for any organization or user running A3300R firmware versions below the patched version.
Exploit ScenarioDerived	An authenticated attacker with valid credentials to the Totolik A3300R web interface can navigate to the VPN configuration section or craft a direct HTTP request targeting /cgi-bin/cstecgi.cgi with a crafted pptpPassThru parameter containing shell metacharacters and commands. For example, a payload such as pptpPassThru=test;id; or pptpPassThru=$(whoami) would execute arbitrary shell commands with the privilege level of the CGI process. The publicly available GitHub exploit (https://github.com/LvHongW/Vuln-of-totolink_A3300R) provides a ready-to-use proof of concept that can automate this attack, significantly lowering the skill required for exploitation. Once command execution is achieved, an attacker can read sensitive configuration files, modify router settings, pivot to the local network, or establish persistence.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 2.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 30, 2026

Command injection in Totolink A3300R firmware version 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via manipulation of the pptpPassThru parameter in the setVpnPassCfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (medium severity) with network-accessible attack vector and low complexity; publicly available exploit code exists, making this an actionable threat for affected deployments.

RemediationAI

Immediately upgrade the Totolik A3300R firmware to the patched version released by the vendor. Patch availability and the specific fixed firmware version have not been independently confirmed from the provided references; however, users should visit https://www.totolik.net/ and check for firmware updates available for the A3300R model. Until a patch can be applied, restrict administrative access to the device by enforcing strong authentication credentials, disabling remote management interfaces if not required, and limiting access to the web management interface to trusted IP addresses only. Ensure the device is not exposed to untrusted networks without additional protective controls (e.g., VPN, firewall rules).

Affected VersionsENISA

A3300R 17.0.0cu.557_b20221024

Affected Packages

euvd a3300r no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the Parameter Handler component of Totolik A3300R router firmware, specifically within the CGI script cstecgi.cgi. The setVpnPassCfg function fails to properly sanitize the pptpPassThru parameter before passing it to system command execution, allowing injection of shell metacharacters. This is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), a command injection flaw in a CGI-based parameter processing routine. The attack targets the VPN configuration functionality, suggesting the vulnerable code path processes user-controlled input through shell invocation without adequate escaping or validation.

Know when A3300R gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 15:40 vuln.today

Public exploit code

CVE Published

Mar 30, 2026 - 03:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was detected in Totolink A3300R 17.0.0cu.557_b20221024. The affected element is the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument pptpPassThru results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Threat Intelligence Overview

EPSS Score

2.9%

Top 14% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 2.9%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.