CVE-2026-5176 is an OS command injection (CWE-77) in Totolink A3300R firmware 17.0.0cu.557_b20221024, in the setSyslogCfg function of cstecgi.cgi. NVD scores it 7.3 high and says a public exploit exists. No fixed firmware is named, so close remote admin access and check for an update.
What's affected
Totolink A3300R firmware 17.0.0cu.557_b20221024, per the CVE record. The affected function is setSyslogCfg in /cgi-bin/cstecgi.cgi, and the public write-up names the log server setting as the input that is passed on to a system command.
No patched firmware is named. Other builds may be affected, but the record does not say.
How to check if you're exposed
Read the firmware version in the router's admin page and compare it with 17.0.0cu.557_b20221024.
Then check whether the admin interface is open to the internet. From a network outside your own, try the router's public address on the web admin port. If it responds, remote management is enabled and should be turned off.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find every Totolink A3300R, including ones at branch sites.
- Disable remote management and limit the admin page to the LAN.
- Check the Totolink download page for firmware newer than the affected build, and apply it when it is confirmed to address this issue.
- Change the admin password and review any settings you did not make, such as log server addresses.
- Replace the device if the vendor ships no fix and it sits at a network edge.
Why it matters
Command injection (CWE-77, within the broader injection class CWE-74) happens when input is built into a command string that the system then runs. The public write-up traces the log server value through the firmware code to a function that runs it as a command.
A router runs with high privileges, so a successful attack gives control of a device that sees all traffic. The record does not mark the CVE as exploited in the wild and it is not in the CISA Known Exploited Vulnerabilities catalog, but it does say a public exploit exists.
Quick check
Does turning off remote admin fully protect me?
It removes the easiest path. Anyone inside your network, or any device on it that is compromised, could still reach the admin page.
Is there a firmware fix?
None is named in the record. Check the vendor site.
Sources
Last reviewed: 19 October 2026.
