CVE-2026-5679

🗓️ 06 Apr 2026 19:00:19Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 1 Views🌐 WEB

CVE-2026-5679: Totolink A3300R vulnerability in vsetTr069Cfg allows command injection via stun_pass.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-5679	6 Apr 202619:00	–	attackerkb
CNNVD	TOTOLINK A3300R 操作系统命令注入漏洞	6 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-5679 Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection	6 Apr 202619:00	–	cvelist
EUVD	EUVD-2026-19464	6 Apr 202621:31	–	euvd
NVD	CVE-2026-5679	6 Apr 202620:16	–	nvd
Positive Technologies	PT-2026-30716	6 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-5679	7 Apr 202623:01	–	redhatcve
Vulnrichment	CVE-2026-5679 Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection	6 Apr 202619:00	–	vulnrichment

[
  {
    "vendor": "Totolink",
    "product": "A3300R",
    "versions": [
      {
        "version": "17.0.0cu.557_B20221024",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:o:totolink:a3300r_firmware:*:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/submit/792798
vuldb	www.vuldb.com/vuln/355506/cti
totolink	www.totolink.net/
github	www.github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-pass-cmd-injection
vuldb	www.vuldb.com/vuln/355506
vuldb	www.vuldb.com/submit/792650

Parameter	Position	Path	Description	CWE
stun_pass	request body	/cgi-bin/cstecgi.cgi	OS command injection via stun_pass parameter in vsetTr072? No, vsetTr069Cfg function of cstecgi.cgi (Totolink A3300R)	CWE-78, CWE-77

29 Apr 2026 01:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 45.1

CVSS 25.2

CVSS 3.15.5

CVSS 35.5

EPSS0.00348

SSVC