VulnerabilityAnalyzed

CVE-2026-5176

Performing a manipulation of the argument provided results in command injection.

MEDIUM 5.5EPSS 2.13%

Does this matter?

Lower severity and a low EPSS score (2.13%). Track it; it rarely justifies an emergency change on its own.

Description

A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. Affected is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument provided results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0: 5.5 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 2.13% probability · 81th percentile
CISA KEV: Not listed
Weakness: CWE-74, CWE-77
Affected: totolink/a3300r firmware
Source: cna@vuldb.com

References

https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_rtLogServer_cmd_injectExploit, Third Party Advisory
https://vuldb.com/submit/779145Third Party Advisory, VDB Entry
https://vuldb.com/vuln/354244Third Party Advisory, VDB Entry
https://vuldb.com/vuln/354244/ctiPermissions Required, VDB Entry
https://www.totolink.net/Product

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.