CVE-2026-4497 - Vulnerability Details

- Totolink WA300 cstecgi.cgi recvUpgradeNewFw os command injection

Description

A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. Affected by this issue is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi. This manipulation causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Published: 2026-03-20

Score: 6.9 Medium

EPSS: 2.6% Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in the recvUpgradeNewFw function of the cstecgi.cgi script on Totolink WA300 routers. Manipulating this endpoint allows an unauthenticated remote actor to inject arbitrary operating‑system commands, resulting in full remote code execution. The weakness is a classic OS command injection, corresponding to CWE‑77 and CWE‑78. An attacker can run any command on the underlying firmware, potentially compromising the entire device and any network services it hosts.

Affected Systems

Affected devices are Totolink WA300 routers running firmware version 5.2cu.7112_B20190227. The vulnerability is confined to the specific cgi module in this firmware build; newer firmware revisions are not known to contain the issue.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity, while an EPSS score of 4% suggests a low to moderate probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation yet. Attackers can target the device over the network by sending crafted CGI requests to /cgi-bin/cstecgi.cgi; no local access or privileged credentials are required.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Totolink

WA300

affected

Version	Status	Constraints
`5.2cu.7112_B20190227`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:totolink:wa300_firmware:5.2cu.7112_b20190227:*:*:*:*:*:*:*

cpe:2.3:h:totolink:wa300:-:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Totolink

Wa300

100%

Version	Status	Scheme	Platform
`5.2cu.7112_B20190227`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the device firmware to a version where recvUpgradeNewFw does not accept arbitrary command parameters, or otherwise installs the official security patch from Totolink.
If a firmware update is not immediately available, block external access to /cgi-bin/cstecgi.cgi using a firewall or router ACL, limiting exposure to internal users only.
Regularly verify that the URL no longer accepts command parameters by attempting a benign test, and monitor system logs for suspicious command executions.

Generated by OpenCVE AI on April 3, 2026 at 13:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.02641.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/hellonestor/killallbug/issues/1
https://github.com/user-attachments/files/25790616/Unauthenticated.Remote.Code.Execution.in.TOTOLINK.WA300.via.Command.Injection.in.recvUpgradeNewFw.zip
https://vuldb.com/?ctiid.352046
https://vuldb.com/?id.352046
https://vuldb.com/?submit.773875
https://www.totolink.net/

History

Fri, 03 Apr 2026 11:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:h:totolink:wa300:-:::::::* cpe:2.3:o:totolink:wa300_firmware:5.2cu.7112_b20190227:::::::*

Mon, 23 Mar 2026 10:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Totolink wa300
Vendors & Products		Totolink wa300

Fri, 20 Mar 2026 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 20 Mar 2026 19:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. Affected by this issue is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi. This manipulation causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Title		Totolink WA300 cstecgi.cgi recvUpgradeNewFw os command injection
First Time appeared		Totolink Totolink wa300 Firmware
Weaknesses		CWE-77 CWE-78
CPEs		cpe:2.3:o:totolink:wa300_firmware::::::::
Vendors & Products		Totolink Totolink wa300 Firmware
References		https://github.com/hellonestor/killallbug/issues/1 https://github.com/user-attachments/files/25790616/Unauthenticated.Remote.Code.Execution.in.TOTOLINK.WA300.via.Command.Injection.in.recvUpgradeNewFw.zip https://vuldb.com/?ctiid.352046 https://vuldb.com/?id.352046 https://vuldb.com/?submit.773875 https://www.totolink.net/
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Totolink Wa300 Wa300 Firmware

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-03-20T19:02:12.950Z

Updated: 2026-03-20T21:23:40.061Z

Reserved: 2026-03-20T09:21:26.000Z

Link: CVE-2026-4497

Vulnrichment

Updated: 2026-03-20T21:23:34.156Z

NVD

Status : Analyzed

Published: 2026-03-20T19:16:20.533

Modified: 2026-04-03T11:31:28.550

Link: CVE-2026-4497

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-03T21:18:15Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object