CVE-2026-5102
Published: 30 March 2026
Summary
CVE-2026-5102 is a medium-severity Injection (CWE-74) vulnerability in Totolink A3300R Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5102 is a command injection vulnerability in the Totolink A3300R router running firmware version 17.0.0cu.557_b20221024. The flaw resides in the setSmartQosCfg function within the /cgi-bin/cstecgi.cgi file of the Parameter Handler component, where manipulation of the qos_up_bw argument enables arbitrary command execution. It is classified under CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection), with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by attackers who possess low privileges, such as authenticated users on the device. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling attackers to execute arbitrary commands on the underlying system without requiring user interaction.
References include a public exploit published on GitHub at https://github.com/Litengzheng/vul_db/blob/main/A3300R/vul_40/README.md, along with VulDB entries detailing the issue (https://vuldb.com/vuln/354127 and related pages). Security practitioners should consult the vendor's site at https://www.totolink.net/ for any available patches or firmware updates, as the exploit's public release increases the risk of active attacks.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17050
Vulnerability details
A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. This vulnerability affects the function setSmartQosCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument qos_up_bw results in command injection. The attack can be executed…
more
remotely. The exploit has been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in router's web CGI enables exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation and sanitization of untrusted inputs like the qos_up_bw parameter to prevent command injection in the setSmartQosCfg function.
SI-2 mandates timely flaw remediation through firmware updates to eliminate the command injection vulnerability in Totolink A3300R.
AC-6 enforces least privilege on the Parameter Handler process to limit the scope and impact of arbitrary commands executed via injection.