Description
A security vulnerability has been detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Affected products
totolink: a3300r firmware; totolink: a3300r
References5
- github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/se… ExploitThird Party Advisory
- vuldb.com/?ctiid.329910 Permissions RequiredVDB Entry
- vuldb.com/?id.329910 Third Party AdvisoryVDB Entry
- vuldb.com/?submit.673722 Third Party AdvisoryVDB Entry
- www.totolink.net/ Product
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0
-
7.4
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 58 · as of 10 November 2026
- CWE
- CWE-119CWE-120
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.