CVE-2026-5679
MediumCVSS 5.5Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
A vulnerability was detected in Totolink A3300R 17.0.0cu.557_B20221024 allowing OS command injection via the vsetTr069Cfg function in /cgi-bin/cstecgi.cgi. The attack can be launched remotely and the exploit is publicly available.
Risk Assessment
A remote attacker can gain unauthorized access to the device and execute arbitrary commands, potentially leading to full compromise of the router.
Recommendation
Immediately update the device firmware to the latest version and disable unnecessary remote services.
Original NVD description (English source)
A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_B20221024. The impacted element is the function vsetTr069Cfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument stun_pass leads to os command injection. The exploit has been disclosed publicly and may be used.