Which versions of Totolink WA300 are affected by CVE-2026-7717?

CVE-2026-7717 is a buffer overflow vulnerability in Totolink WA300 range extender firmware that permits authenticated attackers to execute arbitrary code or disable affected devices through a network…

Is there a public PoC exploit available for CVE-2026-7717?

Yes, a public proof-of-concept exploit is available for CVE-2026-7717. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-7717?

Within 24 hours: Inventory all Totolink WA300 devices and identify those running firmware 5.2cu.7112_B20190227 or earlier; isolate affected devices from untrusted network segments if feasible. Within 7 days: Contact Totolik support to confirm patch availability timeline and expected release date; implement network-level access controls restricting access to /cgi-bin/cstecgi.cgi to trusted administrative IPs only. Within 30 days: Apply vendor-released patch immediately upon availability; if no patch is released within 30 days, evaluate device replacement or permanent decommissioning.

Totolink WA300 CVE-2026-7717

Q: What is the CVSS score of CVE-2026-7717?

CVE-2026-7717 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-26868 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-04 VulDB

Buffer Overflow Wa300

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 04, 2026 - 15:18 vuln.today

Public exploit code

Analysis Generated

May 04, 2026 - 01:48 vuln.today

CVSS changed

May 04, 2026 - 01:22 NVD

8.8 (HIGH) 7.4 (HIGH)

EUVD ID Assigned

May 04, 2026 - 01:15 euvd

EUVD-2026-26868

Analysis Generated

May 04, 2026 - 01:15 vuln.today

CVE Published

May 04, 2026 - 01:00 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Executing a manipulation of the argument File can lead to buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Buffer overflow in Totolink WA300 wireless range extender firmware 5.2cu.7112_B20190227 allows authenticated remote attackers to execute arbitrary code or crash the device via crafted File parameter to the UploadCustomModule function in /cgi-bin/cstecgi.cgi. Public proof-of-concept exploit exists (documented in Notion page), enabling low-skill exploitation. EPSS data not available, but low attack complexity (AC:L) and network attack vector (AV:N) combined with public POC indicate elevated real-world risk for affected devices exposed to untrusted authenticated users.

Technical ContextAI

This vulnerability affects the Totolink WA300 wireless range extender, specifically the POST request handler in the /cgi-bin/cstecgi.cgi CGI endpoint. The underlying issue is CWE-120 (Buffer Copy Without Checking Size of Input), a classic memory safety flaw in C/C++ code common in embedded device firmware. The UploadCustomModule function fails to validate the size of data passed through the File parameter before copying it to a fixed-size buffer, allowing an attacker to write beyond buffer boundaries. This class of vulnerability in CGI handlers is particularly dangerous because it processes network-reachable HTTP requests and typically runs with elevated privileges on embedded devices. The affected CPE string (cpe:2.3:a:totolink:wa300:*:*:*:*:*:*:*:*) indicates all versions of the WA300 product line may be vulnerable, though the description specifically confirms version 5.2cu.7112_B20190227.

RemediationAI

Check Totolink's official support site (https://www.totolink.net/) for firmware updates for the WA300 model, though no specific patched version is confirmed in available intelligence at time of analysis. If updated firmware is available, upgrade immediately following vendor instructions. In absence of vendor patch, implement compensating controls: restrict administrative access to the device management interface to trusted networks only by disabling remote management and accessing only via local LAN; change default administrative credentials to strong unique passwords (minimum 16 characters) to raise the authentication barrier; place WA300 devices on isolated network segments without direct internet exposure to management interfaces; monitor device logs for unexpected POST requests to /cgi-bin/cstecgi.cgi; consider replacing affected devices with alternative models if vendor support appears abandoned (last confirmed firmware from 2019). Note that disabling the UploadCustomModule functionality may not be user-configurable. Device replacement may be most practical solution given the age of affected firmware and potential lack of ongoing vendor support for this consumer product line.