# CVE-2026-5679: Totolink A3300R OS command injection in vsetTr069Cfg

Source: https://junglewise.ai/threats/cve-2026-5679-totolink-a3300r-os-command-injection-in-vsettr069cfg  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5679 · Severity: medium · CVSS 5.5 · Published 2026-04-06

A security vulnerability exists in the Totolink A3300R wireless router, a device used to provide internet connectivity in homes and small offices. An attacker with access to the local network can take control of the device by sending a specially crafted request to its management interface. This could allow an unauthorized user to disrupt internet service, intercept network traffic, or use the router as a foothold for further attacks on the internal network.

Technologies: [TOTOLINK A3300R](https://junglewise.ai/threats/technologies/a3300r). Vendors: [TOTOLINK](https://junglewise.ai/threats/vendors/totolink).

## Quick answers

**Is CVE-2026-5679 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5679 being exploited in the wild.

**How severe is CVE-2026-5679?** Medium severity, with a CVSS score of 5.5, published 6 April 2026.

**Which products and versions are affected?** TOTOLINK A3300R 17.0.0cu.557_B20221024.

**Is there a fix for CVE-2026-5679?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5679 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-5679?** Check whether you run TOTOLINK A3300R at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in the Totolink A3300R router firmware version 17.0.0cu.557_B20221024. The flaw is located within the vsetTr069Cfg function in /cgi-bin/cstecgi.cgi, where the application fails to properly sanitize the 'stun_pass' argument before passing it to a system execution function. Specifically, the sub_4100F0 function retrieves the stun_pass value and uses sprintf to concatenate it into a command string that is eventually executed via execv through the CsteSystem wrapper. An authenticated attacker with adjacent network access can exploit this by sending a crafted POST request containing shell metacharacters (e.g., $(command)) to achieve arbitrary code execution on the underlying Linux operating system. Public exploit code (PoC) has been disclosed.

## Affected products

- Totolink A3300R 17.0.0cu.557_B20221024

## Timeline

- 2026-04-06: disclosed: Vulnerability disclosed via VulDB and GitHub PoC
- 2026-04-06: advisory: NVD published the CVE record

## References

- [https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-pass-cmd-injection](https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-stun-pass-cmd-injection)
- [https://vuldb.com/submit/792650](https://vuldb.com/submit/792650)
- [https://vuldb.com/submit/792798](https://vuldb.com/submit/792798)
- [https://vuldb.com/vuln/355506](https://vuldb.com/vuln/355506)
- [https://vuldb.com/vuln/355506/cti](https://vuldb.com/vuln/355506/cti)
- [https://www.totolink.net/](https://www.totolink.net/)

## Related threats

- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary…](https://junglewise.ai/threats/cve-2026-31173-an-issue-was-discovered-in-totolink-a3300r-firmware-v17-0-0cu-557)
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary…](https://junglewise.ai/threats/cve-2026-31169-an-issue-was-discovered-in-totolink-a3300r-firmware-v17-0-0cu-557)
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary…](https://junglewise.ai/threats/cve-2026-31168-an-issue-was-discovered-in-totolink-a3300r-firmware-v17-0-0cu-557)
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary…](https://junglewise.ai/threats/cve-2026-31167-an-issue-was-discovered-in-totolink-a3300r-firmware-v17-0-0cu-557)
- [An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary…](https://junglewise.ai/threats/cve-2026-31166-an-issue-was-discovered-in-totolink-a3300r-firmware-v17-0-0cu-557)