CVE-2025-52046 is a critical (CVSS 9.8) command injection in the TOTOLINK A3300R router, firmware V17.0.0cu.596_B20250515. The record says unauthenticated attackers can run commands through the mac and desc parameters. No fixed firmware is confirmed, so restrict access and check TOTOLINK.
What's affected
TOTOLINK A3300R firmware V17.0.0cu.596_B20250515, per the record. The record places the flaw in a function it calls sub_4197C0 and names the mac and desc parameters. The write-up in the references is titled for the setWiFiAclRules feature, which is the wireless access control list, though the record text itself does not say so.
The record names no patched firmware, and the references are two researcher write-ups rather than a vendor advisory. I could not confirm that a fix exists. Check TOTOLINK's support and download pages for the A3300R before assuming otherwise.
Note the build stamp in the version string, B20250515, is recent, so this is not an old, long abandoned firmware. That makes a vendor fix more plausible than for the older TOTOLINK entries.
How to check if you're exposed
Read the firmware version on the router's management page. If it matches the one above, treat the device as affected.
Check whether the management interface answers from outside your network. It should not. Look at remote management, port forwarding and any cloud management option, and turn off what you do not use.
If you manage many devices, ask for a list of routers with firmware versions. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan, which checks the packages your own projects use against the Gold directory. It will not find a commercial product installed on a server, so pair it with an inventory of what runs where.
What to do now
- Find every A3300R and record its firmware version.
- Turn off remote administration and limit the management page to a trusted internal address.
- Check TOTOLINK's site for newer firmware, read the release notes and update when one covers this issue.
- Review the router's settings for changes you did not make, such as DNS servers, port forwards and wireless access list entries.
- If the device stays unfixed and exposed, plan to replace it.
Why it matters
The record lists CWE-77 (Command Injection). Command injection happens when a device builds a system command from text a user sent and does not neutralise the parts that the command shell treats as instructions. The device then runs more than the author meant.
On a router that usually means the commands run with high rights. The vector is the worst combination: remote, low complexity, no privileges, no user interaction, and high impact on all three security properties. Small router firmware often builds shell commands for convenience, so one such flaw is rarely alone.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild. Public write-ups are referenced.
Quick check
Do attackers need a password to use this flaw?
No, per the record. It describes unauthenticated attackers, and the CVSS vector lists no privileges required.
Is the fix available?
I could not confirm a fixed firmware from the sources available. Check TOTOLINK's support pages for the A3300R and read the release notes.
Sources
Last reviewed: 18 October 2026.
