The flaw is a command injection vulnerability in the Totolink WA300 router firmware version 5.2cu.7112_B20190227. An attacker can send a crafted value for the webWlanIdx parameter to the /cgi-bin/cstecgi.cgi POST endpoint, which is then executed by the operating system. The culprit is a lack of proper input sanitisation (CWE‑74) combined with the use of the argument in a shell context (CWE‑77). Based on the description, it is inferred that an attacker can execute arbitrary OS commands, potentially giving them full control over the device.

The affected product is the Totolink WA300 router running firmware 5.2cu.7112_B20190227. No other firmware releases are identified as vulnerable.

The CVSS score of 5.3 classifies the risk as moderate, yet the exploit is publicly available and can be triggered remotely via an unauthenticated POST request. Because the EPSS score is 2% and the vulnerability is not listed in CISA’s KEV catalog, the exposure largely depends on the router’s network visibility, but the ability to run arbitrary commands suggests a high potential impact once the device is reachable.