The Totolink WA300 firmware contains a classic buffer overflow in the loginauth function of the cstecgi.cgi component, triggered by malicious manipulation of the http_host argument in a POST request. This flaw is a stack-based overflow that violates bounds checking, exposing the system to arbitrary code execution and compromising confidentiality, integrity, and availability. The vulnerability is classified under CWE-119 and CWE-120 and is listed with a CVSS score of 9.3.

Vendors impacted are Totolink devices running the WA300 line, specifically firmware version 5.2cu.7112_B20190227. The flaw resides in the POST Request Handler of /cgi-bin/cstecgi.cgi and may affect all units with this firmware build.

The high CVSS of 9.3 indicates a severe security risk, and although an EPSS score is not available, the public release of an exploit and its remote launch capability suggest an elevated likelihood of attack. The vulnerability is not listed in CISA’s KEV catalog, but its remote nature and usage of a widely used HTTP header component make it attractive to attackers. The most likely attack vector is a remote attacker crafting an HTTP POST request with a malformed http_host value to trigger the overflow.