Vulnerability · Published May 4, 2026 · Assigned by VulDB

CVE-2026-7720Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection

Medium 6.3

In plain English

A medium-severity command injection in WA300 from Totolink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)1.0%top 36.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. This manipulation of the argument langType causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Affected products (as reported)

Vendor	Product	Versions
Totolink	WA300	5.2cu.7112_B20190227

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-360896 | Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection vdb-entry, technical-description
VDB-360896 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #807198 | Totolink WA300 WA300 V5.2cu.7112_B20190227 Command Injection third-party-advisory
https://lavender-bicycle-a5a.notion.site/TOTOLINK-WA300-setLanguageCfg-34553a41781f8007b6c5c7964d424286 exploit
https://www.totolink.net/ product