A buffer overflow flaw exists in the UploadCustomModule operation of the /cgi-bin/cstecgi.cgi file within Totolink WA300 routers. By supplying a crafted File argument in a POST request, an attacker can overflow a memory buffer, potentially corrupting execution flow. The flaw can be exploited remotely without authentication and could allow arbitrary code execution or denial of service on the affected device.

The vulnerability is confirmed only in Totolink WA300 devices running firmware version 5.2cu.7112_B20190227. There is insufficient information to determine whether other firmware releases are affected; the status of unmodified code paths in those versions is unknown.

The CVSS score of 8.7 classifies this as a high‑severity issue. EPSS information is not available, but the vulnerability is publicly disclosed and can be triggered remotely, indicating a tangible exploitation risk. The issue is not listed in the CISA KEV catalog, yet the lack of mitigation and public exploit availability suggest that attackers may target vulnerable devices in the wild.