CVE-2026-7718
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
A vulnerability was identified in Totolink WA300 (version 5.2cu.7112_B20190227) in the setWebWlanIdx function of /cgi-bin/cstecgi.cgi. Manipulating the webWlanIdx argument leads to command injection, and the attack can be initiated remotely. The exploit is publicly available and might be used.
Risk Assessment
A remote attacker could execute arbitrary commands on the device, potentially taking control of the router and network. Public exploit availability increases the risk of attack.
Recommendation
Update the device firmware to a patched version or restrict access to the management interface. Until patched, consider disabling remote management and segmenting the network.
Other vulnerabilities in Totolink WA300
See all- CVE-2026-7721Medium
In Totolink WA300 5.2cu.7112_B20190227, the NTPSyncWithHost function in /cgi-bin/cstecgi.cgi allows command injection through manipulation of the hostTime argument. The attack can be executed remotely, and the exploit has been publicly disclosed.
- CVE-2026-7720Medium
A vulnerability was found in Totolink WA300 (version 5.2cu.7112_B20190227) in the setLanguageCfg function of /cgi-bin/cstecgi.cgi. Manipulating the langType argument leads to command injection, and the attack can be performed remotely. The exploit has been publicly released and may be used.
- CVE-2026-0641Medium
A vulnerability was detected in TOTOLINK WA300 version 5.2cu.7112_B20190227 affecting the sub_401510 function in cstecgi.cgi. Manipulation of the UPLOAD_FILENAME argument leads to command injection, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A vulnerability was identified in Totolink WA300 5.2cu.7112_B20190227. Impacted is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument webWlanIdx leads to command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS