Vulnerability · Published May 4, 2026 · Assigned by VulDB

CVE-2026-7719Totolink WA300 POST Request cstecgi.cgi loginauth buffer overflow

Critical 9.8

In plain English

A critical-severity buffer overflow in WA300 from Totolink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 50.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in Totolink WA300 5.2cu.7112_B20190227. The affected element is the function loginauth of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument http_host results in buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Affected products (as reported)

Vendor	Product	Versions
Totolink	WA300	5.2cu.7112_B20190227

Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-360895 | Totolink WA300 POST Request cstecgi.cgi loginauth buffer overflow vdb-entry, technical-description
VDB-360895 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #807197 | Totolink WA300 WA300 V5.2cu.7112_B20190227 Buffer Overflow third-party-advisory
https://lavender-bicycle-a5a.notion.site/TOTOLINK-WA300-loginAuth-34553a41781f8050b8ffc9e90a103cd5 exploit
https://www.totolink.net/ product