CVE-2026-5176: Totolink A3300R command injection in cstecgi.cgi setSyslogCfg

Overview

The VulDB record describes a command injection issue in the setSyslogCfg function of the file /cgi-bin/cstecgi.cgi on the Totolink A3300R, firmware 17.0.0cu.557_b20221024. The weakness is classified as CWE-74 (Injection). The record states that the attack may be initiated remotely. See the VulDB entry for the third-party technical description.

Impact

• Command injection in a network-reachable management function can, in general, allow an attacker to run operating system commands on the device if exploited successfully.
• NVD assigns a CVSS base score of 9.8, which is in the critical range. Other providers in the record (VulDB and the CNA) assign different scores.
• SSVC data in the record lists exploitation as proof-of-concept, automatable as yes and technical impact as partial. This is an inference from the record's scoring fields and does not confirm real-world impact.

Affected products and versions

• Totolink A3300R, version 17.0.0cu.557_b20221024.
• Totolink A3300r Firmware, version 17.0.0cu.557_b20221024.
• No other affected versions are listed in the sources consulted. Whether earlier or later firmware is affected is unknown.

Exploitation status

• The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is stated.
• The record and its references indicate that a public exploit has been released. A public exploit repository is listed among the references.
• No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

• No fixed version is listed in the record. The absence of a listed fix does not mean no fix exists; it means the sources consulted do not identify one.
• Check the vendor site, Totolink, for firmware updates or security notices for the A3300R.
• Limit access to the device management interface to trusted networks, and avoid exposing it to the internet.
• Where a patch is not available, consider replacing or isolating the device according to your risk policy.

Detection guidance

• Review device and network logs for unexpected requests to the cstecgi.cgi endpoint, especially from unknown sources.
• Monitor for unexpected configuration changes or device behavior that could indicate unauthorized command execution.
• Keep an inventory of Totolink A3300R devices so exposure can be assessed quickly.

Limitations of the available information

• The record does not provide vendor advisory text, a fixed version, or proof of real-world exploitation.
• CVSS scores differ across providers, and the scoring rationale is not detailed in the record.
• The EPSS data in the record carries a date that should be verified against the source before relying on it.
• Technical details of the vulnerable parameter are not given here and are intentionally omitted.

Frequently asked questions

Is CVE-2026-5176 being actively exploited?

The CISA KEV catalog does not list this CVE in the record, so active exploitation is not confirmed. The record notes a public exploit has been released, but no confirmed exploitation in the wild appears in the sources consulted.

Which Totolink A3300R versions are affected?

The sources consulted list firmware 17.0.0cu.557_b20221024 for the Totolink A3300R and the Totolink A3300r Firmware. Other versions are not identified, so their status is unknown.

What should administrators do now?

No fixed version is listed in the record. Check the vendor for updates, restrict access to the management interface, avoid internet exposure, and monitor logs for unexpected requests to cstecgi.cgi.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.