CVE-2026-5103
Published: 30 March 2026
Summary
CVE-2026-5103 is a medium-severity Injection (CWE-74) vulnerability in Totolink A3300R Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation of the specific command injection flaw in the Totolink A3300R router's setUPnPCfg CGI function via patching or updates.
Mandates validation and sanitization of the 'enable' argument to prevent arbitrary command injection in the vulnerable CGI endpoint.
Restricts or prohibits unnecessary UPnP configuration functionality and exposed CGI endpoints to reduce the attack surface for remote exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in public-facing router CGI script enables remote exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).
NVD Description
A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. This issue affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument enable causes command injection. The attack is possible to be carried out remotely. The exploit has…
more
been made available to the public and could be used for attacks.
Deeper analysisAI
CVE-2026-5103 is a command injection vulnerability (CWE-74, CWE-77) affecting the Totolink A3300R router in version 17.0.0cu.557_b20221024. The flaw exists in the setUPnPCfg function of the /cgi-bin/cstecgi.cgi file, where manipulation of the "enable" argument enables arbitrary command execution.
The vulnerability is exploitable remotely over the network with low complexity and low privileges required (PR:L), requiring no user interaction and maintaining unchanged scope. Attackers can achieve limited impacts on confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). A public exploit is available, facilitating potential attacks.
Advisories referenced in VulDB entries (including submission and CTI details) document the issue, while a GitHub repository provides exploit code. The Totolink vendor website is also listed for further reference; practitioners should check these sources for any patch availability or mitigation guidance.
The exploit's public availability increases the risk of real-world attacks against unpatched Totolink A3300R devices.
Details
- CWE(s)