GCVE - cpe:2.3:o:totolink:a3300r_firmware:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:totolink:a3300r_firmware:*:*:*:*:*:*:*:*

part: o version: * update: *

Vendor	Totolink (`fa0129e6-aa24-5784-be77-22d8becdb79b`)
Product	A3300R Firmware (`65513ced-0021-58c1-96f4-cd5b8d3d22d0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-5679`	vulnerable	2026-06-08 08:07:03.975220	Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection MEDIUM (5.5) A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_B20221024. The impacted element is the function vsetTr069Cfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument stun_pass leads to os command injection. The exploit has been disclosed publicly and may be used. Published: 2026-04-06T19:00:19.633Z Updated: 2026-04-07T15:10:20.818Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/355506 https://vuldb.com/vuln/355506/cti https://vuldb.com/submit/792650 https://vuldb.com/submit/792798 https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-pass-cmd-injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-5178`	vulnerable	2026-06-08 08:07:03.089994	Totolink A3300R cstecgi.cgi setIptvCfg command injection MEDIUM (6.3) A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this issue is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument vlanPriLan3 leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Published: 2026-03-31T03:00:14.508Z Updated: 2026-04-02T14:54:34.752Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/354246 https://vuldb.com/vuln/354246/cti https://vuldb.com/submit/779147 https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_vlanPriLan3_cmd_inject https://www.totolink.net/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-5177`	vulnerable	2026-06-08 08:07:03.089404	Totolink A3300R cstecgi.cgi setWiFiBasicCfg command injection MEDIUM (6.3) A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this vulnerability is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument rxRate can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. Published: 2026-03-31T02:00:21.538Z Updated: 2026-03-31T13:27:49.031Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/354245 https://vuldb.com/vuln/354245/cti https://vuldb.com/submit/779146 https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_rxRate_cmd_inject https://www.totolink.net/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-5176`	vulnerable	2026-06-08 08:07:03.088838	Totolink A3300R cstecgi.cgi setSyslogCfg command injection HIGH (7.3) A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. Affected is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument provided results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Published: 2026-03-31T01:15:13.970Z Updated: 2026-03-31T15:33:16.783Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/354244 https://vuldb.com/vuln/354244/cti https://vuldb.com/submit/779145 https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_rtLogServer_cmd_inject https://www.totolink.net/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-5105`	vulnerable	2026-06-08 08:07:03.001756	Totolink A3300R Parameter cstecgi.cgi setVpnPassCfg command injection MEDIUM (6.3) A vulnerability was detected in Totolink A3300R 17.0.0cu.557_b20221024. The affected element is the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument pptpPassThru results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Published: 2026-03-30T03:00:20.891Z Updated: 2026-03-30T13:58:27.213Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/354130 https://vuldb.com/vuln/354130/cti https://vuldb.com/submit/779143 https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_pptpPassThru_cmd_inject https://www.totolink.net/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-5104`	vulnerable	2026-06-08 08:07:03.001134	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-5103`	vulnerable	2026-06-08 08:07:03.000591	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-5102`	vulnerable	2026-06-08 08:07:03.000169	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-5101`	vulnerable	2026-06-08 08:07:02.997464	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-12260`	vulnerable	2026-06-08 07:04:29.947279	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-12259`	vulnerable	2026-06-08 07:04:29.946769	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-12258`	vulnerable	2026-06-08 07:04:29.946302	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.