CVE-2026-5105 Overview
CVE-2026-5105 is a command injection vulnerability in the Totolink A3300R router running firmware version 17.0.0cu.557_b20221024. The flaw resides in the setVpnPassCfg function within /cgi-bin/cstecgi.cgi, part of the device's Parameter Handler component. Attackers can manipulate the pptpPassThru argument to inject operating system commands. The vulnerability is remotely exploitable and a public exploit has been disclosed. The issue is tracked under [CWE-74] and [CWE-77], covering improper neutralization of special elements in commands.
Critical Impact
Authenticated remote attackers can inject arbitrary commands into the router's VPN configuration handler via the pptpPassThru parameter, leading to command execution on the device.
Affected Products
- Totolink A3300R firmware version 17.0.0cu.557_b20221024
- Totolink A3300R hardware appliance
- /cgi-bin/cstecgi.cgi Parameter Handler component
Discovery Timeline
- 2026-03-30 - CVE-2026-5105 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2026-5105
Vulnerability Analysis
The Totolink A3300R router exposes the cstecgi.cgi binary to handle configuration requests, including VPN passthrough settings. The setVpnPassCfg function processes the pptpPassThru parameter without proper neutralization of shell metacharacters. An attacker submitting crafted input embeds shell commands that the underlying system interprets during configuration handling.
The CWE classifications [CWE-74] (Improper Neutralization of Special Elements) and [CWE-77] (Command Injection) describe the root cause. The EPSS score of 2.667% (85.959 percentile) indicates measurable interest among threat actors in exploiting this class of router flaw. A public proof-of-concept exists in the GitHub PoC Repository, lowering the barrier to weaponization.
Root Cause
The setVpnPassCfg handler passes the pptpPassThru argument directly into a system command construction routine. The firmware lacks input validation, allowlisting, or shell-escape logic. Any string containing shell separators such as ;, |, or backticks is concatenated into the command string and executed by the OS shell.
Attack Vector
The attack vector is network-based and requires low-privilege authentication to the router's web interface. The attacker issues an HTTP POST request to /cgi-bin/cstecgi.cgi invoking the setVpnPassCfg operation. The malicious payload is supplied in the pptpPassThru field. The router executes the injected commands with the privileges of the CGI process, typically root on consumer-grade firmware.
No verified exploit code is reproduced here. See the VulDB entry #354130 and the GitHub PoC Repository for technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-5105
Indicators of Compromise
- HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setVpnPassCfg topicurl and shell metacharacters in pptpPassThru.
- Unexpected child processes spawned by the cstecgi.cgi binary, particularly shells or network utilities such as wget, curl, nc, or telnetd.
- Outbound connections from the router to unfamiliar hosts following VPN configuration changes.
Detection Strategies
- Inspect HTTP request bodies sent to the router's management interface for shell separators including ;, &&, |, and $() within VPN parameters.
- Monitor router syslog and CGI access logs for repeated calls to setVpnPassCfg from internal or external sources.
- Apply network IDS signatures targeting command injection patterns in Totolink CGI endpoints.
Monitoring Recommendations
- Forward router logs to a centralized log platform and alert on configuration changes outside maintenance windows.
- Track DNS and outbound traffic from the router for beacon-like behavior indicating post-exploitation activity.
- Audit the router's management interface exposure and restrict access to a management VLAN.
How to Mitigate CVE-2026-5105
Immediate Actions Required
- Remove the Totolink A3300R management interface from any WAN-facing exposure.
- Restrict LAN access to /cgi-bin/cstecgi.cgi to trusted administrative hosts only.
- Rotate any administrative credentials on the device and review configured VPN passthrough settings for tampering.
- Inspect the device for persistence indicators and consider a factory reset if compromise is suspected.
Patch Information
No vendor advisory or firmware update was referenced in the published CVE data at the time of writing. Consult the Totolink Official Website for updated firmware releases. Until a fix is available, treat affected devices as exposed and apply network-level compensating controls.
Workarounds
- Disable remote administration on the router and block inbound access to TCP/80 and TCP/443 from untrusted networks.
- Place the router behind an upstream firewall that filters HTTP requests to the management path.
- Replace end-of-life Totolink devices that no longer receive security updates with supported hardware.
# Example firewall rule restricting management interface access
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
