CVE-2026-5679

CVE-2026-5679 is an OS command injection vulnerability in Totolik A3300R router firmware version 17.0.0cu.557_B20221024, specifically affecting the vsetTr069Cfg function in the /cgi-bin/cstecgi.cgi endpoint through improper handling of the stun_pass parameter. The vulnerability has been publicly disclosed, allowing unauthenticated or low-privilege attackers to execute arbitrary system commands on affected devices. The vulnerability carries a CVSS score of 5.5 (Medium) with an adjacent network attack vector, low complexity requirements, and low privilege access needed for exploitation. Successful exploitation could result in limited confidentiality, integrity, and availability impacts on the affected router. The EPSS score of 0.0034 indicates relatively low predictive exploitation probability compared to the broader CVE landscape, suggesting this threat is not currently widespread. There is no indication of active exploitation in the wild, as reflected by the vulnerability's absence from the Known Exploited Vulnerabilities (KEV) catalog and its inactive status on threat hot lists. However, given the public disclosure of the vulnerability and its technical simplicity, organizations operating Totolik A3300R routers should prioritize patching to mitigate potential future exploitation attempts.