CVE-2026-0641
MediumCVSS 6.3Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
A vulnerability was detected in TOTOLINK WA300 version 5.2cu.7112_B20190227 affecting the sub_401510 function in cstecgi.cgi. Manipulation of the UPLOAD_FILENAME argument leads to command injection, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.
Risk Assessment
A remote attacker could execute arbitrary commands on the device, taking full control. This can lead to complete compromise of confidentiality, integrity, and availability of the network.
Recommendation
Update the TOTOLINK WA300 firmware to a non-vulnerable version as soon as possible or remove the device from public exposure. Restrict access to the management interface and monitor for unusual activity.
Other vulnerabilities in TOTOLINK WA300
See all- CVE-2026-7721Medium
In Totolink WA300 5.2cu.7112_B20190227, the NTPSyncWithHost function in /cgi-bin/cstecgi.cgi allows command injection through manipulation of the hostTime argument. The attack can be executed remotely, and the exploit has been publicly disclosed.
- CVE-2026-7720Medium
A vulnerability was found in Totolink WA300 (version 5.2cu.7112_B20190227) in the setLanguageCfg function of /cgi-bin/cstecgi.cgi. Manipulating the langType argument leads to command injection, and the attack can be performed remotely. The exploit has been publicly released and may be used.
- CVE-2026-7718Medium
A vulnerability was identified in Totolink WA300 (version 5.2cu.7112_B20190227) in the setWebWlanIdx function of /cgi-bin/cstecgi.cgi. Manipulating the webWlanIdx argument leads to command injection, and the attack can be initiated remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A security vulnerability has been detected in TOTOLINK WA300 5.2cu.7112_B20190227. This vulnerability affects the function sub_401510 of the file cstecgi.cgi. The manipulation of the argument UPLOAD_FILENAME leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS