Totolink A3300r Firmware vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Totolink A3300r Firmware: 37 record(s), with affected versions and fixes.cpe:2.3:o:totolink:a3300r_firmware
CVE-2026-31173
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the interval parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31169
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the week parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31168
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the recHour parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31167
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the mode parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31166
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the hour parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31163
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the dhcpMtu parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31162
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the ttlWay parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31181
Critical · 9.8
CWE-78 Apr 23, 2026
OS Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31179
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunPort parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31178
Critical · 9.8
CWE-78 Apr 23, 2026
OS Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31177
Critical · 9.8
CWE-78 Apr 23, 2026
OS Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31176
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun_user parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31175
Critical · 9.8
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunEnable parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31174
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the informEnable parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31172
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the user parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31171
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the url parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31165
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeServiceName parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31164
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31160
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31159
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the password parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31170
Critical · 9.8
CWE-77 Apr 9, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun-pass parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-5178
High · 8.8
CWE-74 Mar 31, 2026
Totolink A3300R cstecgi.cgi setIptvCfg command injection
A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this issue is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument vlanPriLan3 leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVE-2026-5177
High · 8.8
CWE-74 Mar 31, 2026
Totolink A3300R cstecgi.cgi setWiFiBasicCfg command injection
A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this vulnerability is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument rxRate can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-5176
Critical · 9.8
CWE-74 Mar 30, 2026
Totolink A3300R cstecgi.cgi setSyslogCfg command injection
A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. Affected is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument provided results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-5105
High · 8.8
CWE-77 Mar 30, 2026
Totolink A3300R Parameter cstecgi.cgi setVpnPassCfg command injection
A vulnerability was detected in Totolink A3300R 17.0.0cu.557_b20221024. The affected element is the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument pptpPassThru results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.