Vulnerability · Published Feb 8, 2026 · Assigned by VulDB
CVE-2026-2167Totolink WA300 cstecgi.cgi setAPNetwork os command injection
Medium 6.3
In plain English
A medium-severity OS command injection in WA300 from Totolink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)2.5%top 15.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Ipaddr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.
Affected products (as reported)
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-344869 | Totolink WA300 cstecgi.cgi setAPNetwork os command injection vdb-entry, technical-description
- VDB-344869 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #752063 | TOTOLINK WA300 V5.2cu.7112_B20190227 OS Command Injection third-party-advisory
- https://github.com/master-abc/cve/issues/36 exploit, issue-tracking
- https://www.totolink.net/ product