Medium severity6.3NVD Advisory· Published Mar 30, 2026· Updated Apr 29, 2026
CVE-2026-5105
CVE-2026-5105
Description
A vulnerability was detected in Totolink A3300R 17.0.0cu.557_b20221024. The affected element is the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument pptpPassThru results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
5- github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_pptpPassThru_cmd_injectnvdExploitThird Party Advisory
- vuldb.com/vuln/354130nvdThird Party AdvisoryVDB Entry
- vuldb.com/vuln/354130/ctinvdThird Party AdvisoryVDB Entry
- vuldb.com/submit/779143nvdPermissions RequiredVDB Entry
- www.totolink.netnvdProduct
News mentions
0No linked articles in our index yet.