Description
A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Ipaddr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.
Published: 2026-02-08
Score: 5.3 Medium
EPSS: 2.3% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The setAPNetwork function in the file /cgi-bin/cstecgi.cgi accepts an Ipaddr argument that is not properly sanitized, allowing remote attackers to inject arbitrary OS commands. This vulnerability results in an attacker being able to execute commands with the privileges of the router, potentially compromising its confidentiality, integrity, and availability.

Affected Systems

Totolink WA300 routers running firmware version 5.2cu.7112_B20190227 are affected. No other firmware versions are listed as impacted.

Risk and Exploitability

The CVSS base score of 5.3 indicates a moderate severity. The EPSS score of 2% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit this weakness remotely by sending crafted requests to the setAPNetwork endpoint; it is not specified whether authentication is required, as the description states the attack may be performed from remote.

Generated by OpenCVE AI on June 18, 2026 at 05:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router firmware to a version that eliminates the CWE‑77 and CWE‑78 command‑injection flaw in setAPNetwork.
  • If a patched firmware is unavailable, restrict or block remote access to the /cgi-bin/cstecgi.cgi endpoint, or disable the web administration interface entirely to mitigate the CWE‑77/78 vulnerability.
  • Configure the router or network perimeter to monitor for unusual requests to the Ipaddr parameter and investigate any suspicious activity promptly, treating potential command‑injection attempts as exploitation of CWE‑77/78.

Generated by OpenCVE AI on June 18, 2026 at 05:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 10:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:totolink:wa300_firmware:*:*:*:*:*:*:*:*

Wed, 11 Feb 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink wa300 Firmware
CPEs cpe:2.3:h:totolink:wa300:-:*:*:*:*:*:*:*
cpe:2.3:o:totolink:wa300_firmware:5.2cu.7112_b20190227:*:*:*:*:*:*:*
Vendors & Products Totolink wa300 Firmware

Mon, 09 Feb 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink wa300
Vendors & Products Totolink
Totolink wa300

Sun, 08 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Ipaddr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.
Title Totolink WA300 cstecgi.cgi setAPNetwork os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink Wa300 Wa300 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:45:27.603Z

Reserved: 2026-02-07T09:15:46.201Z

Link: CVE-2026-2167

cve-icon Vulnrichment

Updated: 2026-02-09T21:11:56.867Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-08T17:15:58.970

Modified: 2026-06-17T10:30:27.450

Link: CVE-2026-2167

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T05:15:16Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')