Totolink A3300R Parameter cstecgi.cgi setVpnPassCfg Command Injection

The command injection vulnerability in Totolink A3300R firmware presents a significant security risk. An attacker can leverage this flaw to execute arbitrary system commands remotely, bypassing standard authentication mechanisms. This could lead to complete compromise of the router, including data exfiltration, modification of system configurations, and installation of malicious software. The attacker could potentially pivot from the router to other devices on the network, expanding the blast radius of the attack. Given the public availability of an exploit, the risk of exploitation is elevated, and organizations relying on this router should prioritize remediation.

Organizations and individuals using the Totolink A3300R router with the affected firmware version are at risk. This includes small businesses, home users, and managed service providers who deploy this router in their networks. Shared hosting environments utilizing this router are particularly vulnerable due to the potential for cross-tenant exploitation.

• linux / server:

journalctl -u totolink_router -g "cstecgi.cgi"

• generic web:

curl -s -I 'http://<router_ip>/cgi-bin/cstecgi.cgi?pptpPassThru=<malicious_payload>' | grep 'HTTP/1.1 500' # Check for error responses indicating command execution

1. 2026-03-30Disclosure

   disclosure

1. Reserviert2026-03-29
2. Veröffentlicht2026-03-30
3. EPSS aktualisiert2026-04-06

Due to the lack of a provided fixed_in version, immediate mitigation steps are crucial. First, isolate the affected Totolink A3300R routers from external networks to prevent remote exploitation. Implement strict firewall rules to restrict access to the /cgi-bin/cstecgi.cgi endpoint. Consider deploying a Web Application Firewall (WAF) with rules to filter potentially malicious input in the pptpPassThru parameter, specifically looking for command injection payloads. Monitor router logs for suspicious activity, such as unexpected command executions. Regularly review and harden router configurations, disabling unnecessary services and features. After applying these mitigations, verify their effectiveness by attempting to access the vulnerable endpoint with benign test payloads.