CVE-2026-5101
Published: 29 March 2026
Summary
CVE-2026-5101 is a medium-severity Injection (CWE-74) vulnerability in Totolink A3300R Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by validating the lanIp parameter in the setLanCfg function to block malicious input.
Mitigates the vulnerability through timely flaw remediation by patching the affected Totolink A3300R firmware.
Enables detection of command injection attempts via monitoring for anomalous network connections and privileged events on the router.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing web CGI interface (setLanCfg via lanIp) enables exploitation of public-facing application (T1190) and arbitrary Unix shell command execution on the router (T1059.004).
NVD Description
A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploitation of the attack is possible. The…
more
exploit is publicly available and might be used.
Deeper analysisAI
CVE-2026-5101 is a command injection vulnerability affecting the Totolink A3300R router on firmware version 17.0.0cu.557_b20221024. The issue resides in the setLanCfg function of the /cgi-bin/cstecgi.cgi file within the Parameter Handler component, where manipulation of the lanIp argument triggers command injection. Published on 2026-03-29, it is associated with CWEs-74, CWE-77, and CWE-78, and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation enables arbitrary command execution, potentially leading to low impacts on confidentiality, integrity, and availability, such as limited data access, modification, or disruption on the affected device. A public exploit is available, increasing the risk of widespread use.
Advisories referenced in VULDB entries (vuln/354126 and related CTI) document the vulnerability details and submission, while a GitHub repository provides exploit code and a README. The Totolink vendor website is listed for potential firmware updates or mitigation guidance. Security practitioners should verify patches directly from these sources.
Details
- CWE(s)