CVE-2026-5105 | Totolink A3300R 17.0.0cu.557_b20221024 Parameter /cgi-bin/cstecgi.cgi setVpnPassCfg pptpPassThru command injection

A vulnerability classified as critical has been found in Totolink A3300R 17.0.0cu.557_b20221024. The affected element is the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument pptpPassThru results in command injection.

This vulnerability is cataloged as CVE-2026-5105. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.