Vulnerability · Published May 4, 2026 · Assigned by VulDB
CVE-2026-7717Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow
High 8.8
In plain English
A high-severity buffer overflow in WA300 from Totolink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 59.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Executing a manipulation of the argument File can lead to buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected products (as reported)
Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-360893 | Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow vdb-entry, technical-description
- VDB-360893 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #807193 | Totolink WA300 WA300 V5.2cu.7112_B20190227 Buffer Overflow third-party-advisory
- https://lavender-bicycle-a5a.notion.site/TOTOLINK-WA300-UploadCustomModule-34553a41781f80a8a287e48a7fb04de9 exploit
- https://www.totolink.net/ product