CVE-2026-5177
Published: 31 March 2026
Summary
CVE-2026-5177 is a medium-severity Injection (CWE-74) vulnerability in Totolink A3300R Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A weakness has been identified in the Totolink A3300R router running firmware version 17.0.0cu.557_b20221024. The issue resides in the setWiFiBasicCfg function within /cgi-bin/cstecgi.cgi, where improper handling of the rxRate argument permits command injection. The vulnerability is tracked under CWE-74 and CWE-77 and carries a CVSS 4.0 score of 5.3, reflecting a network-accessible flaw that requires low-privilege credentials but no user interaction.
An authenticated remote attacker can supply a crafted rxRate value to the affected CGI endpoint and execute arbitrary operating-system commands on the device. Successful exploitation grants limited control over confidentiality, integrity, and availability of the router without needing elevated privileges. A proof-of-concept exploit has been published publicly on GitHub, enabling straightforward reproduction of the attack.
The EPSS score for this CVE rose from a low baseline of 0.0060 to a peak of 0.0121, indicating that exploitation interest increased after disclosure. No vendor advisory or patch information is provided in the available references, which include only the Totolink product page and vulnerability database entries.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17281
Vulnerability details
A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this vulnerability is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument rxRate can lead to command injection. The attack may be launched remotely. The…
more
exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via authenticated web interface on public-facing router directly enables T1190 (Exploit Public-Facing Application) and T1059.004 (Unix Shell) execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the command injection flaw in the Totolink A3300R firmware by identifying, reporting, and applying patches to the vulnerable setWiFiBasicCfg function.
Requires validation of the rxRate argument to ensure it contains only expected content, preventing command injection in the cgi-bin/cstecgi.cgi script.
Restricts the rxRate input parameter to authorized formats and values such as numeric rates only, blocking injection payloads.