CVE-2026-7721
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
In Totolink WA300 5.2cu.7112_B20190227, the NTPSyncWithHost function in /cgi-bin/cstecgi.cgi allows command injection through manipulation of the hostTime argument. The attack can be executed remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker may execute arbitrary system commands on the device, potentially leading to full compromise of the router or access point. Public availability of the exploit increases the risk of exploitation.
Recommendation
Restrict access to the device management interface to trusted networks and consider a firmware update if the vendor releases a fix. Until then, monitor and isolate the device.
Other vulnerabilities in Totolink WA300
See all- CVE-2026-7720Medium
A vulnerability was found in Totolink WA300 (version 5.2cu.7112_B20190227) in the setLanguageCfg function of /cgi-bin/cstecgi.cgi. Manipulating the langType argument leads to command injection, and the attack can be performed remotely. The exploit has been publicly released and may be used.
- CVE-2026-7718Medium
A vulnerability was identified in Totolink WA300 (version 5.2cu.7112_B20190227) in the setWebWlanIdx function of /cgi-bin/cstecgi.cgi. Manipulating the webWlanIdx argument leads to command injection, and the attack can be initiated remotely. The exploit is publicly available and might be used.
- CVE-2026-0641Medium
A vulnerability was detected in TOTOLINK WA300 version 5.2cu.7112_B20190227 affecting the sub_401510 function in cstecgi.cgi. Manipulation of the UPLOAD_FILENAME argument leads to command injection, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A security vulnerability has been detected in Totolink WA300 5.2cu.7112_B20190227. This affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument hostTime leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS