CVE-2026-5102

EUVD-2026-17050
A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. This vulnerability affects the function setSmartQosCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument qos_up_bw results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDBCNA
6.3 MEDIUM
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
totolinka3300r_firmware
17.0.0cu.557_b20221024:cu.557_b20221024
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/Litengzheng/vul_db/blob/main/A3300R/vul_40/README.md
https://vuldb.com/submit/779129
https://vuldb.com/vuln/354127
https://vuldb.com/vuln/354127/cti
https://www.totolink.net/