CVE-2026-5103: Totolink A3300R cstecgi.cgi setUPnPCfg command injection
A weakness has been identified in Totolink A3300R 17.0.0cu.557b20221024. This issue affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument enable causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5103?
CVE-2026-5103 is classified as a medium severity vulnerability due to its potential for command injection.
How does CVE-2026-5103 affect the Totolink A3300R?
CVE-2026-5103 affects the function setUPnPCfg in the cstecgi.cgi file, allowing an attacker to execute arbitrary commands.
Can CVE-2026-5103 be exploited remotely?
Yes, CVE-2026-5103 can be exploited remotely if the attacker has access to the affected device.
What versions of Totolink A3300R are impacted by CVE-2026-5103?
CVE-2026-5103 specifically impacts Totolink A3300R version 17.0.0cu.557_b20221024.
How do I mitigate CVE-2026-5103?
To mitigate CVE-2026-5103, it's recommended to update the Totolink A3300R to a fixed version that addresses this vulnerability.