Totolink WA300 CVE-2026-7718

Exploitation requires valid authentication credentials (PR:L - authenticated user or administrator account) to access the /cgi-bin/cstecgi.cgi endpoint. The setWebWlanIdx function must be callable via POST request, which is the default configuration in the affected firmware. No special router configuration is required; the vulnerable code path is enabled in the default state. The attack cannot be executed by unauthenticated remote attackers without first obtaining valid login credentials. User interaction is not required once authentication is established; the injected command executes server-side.

Despite the low CVSS score of 2.1, this vulnerability presents moderate real-world risk due to several factors. The CVSS vector indicates network accessibility (AV:N) and low attack complexity (AC:L), but requires authenticated access (PR:L), which significantly limits the threat surface to users with valid administrative or user credentials on the target router. The impact is constrained to confidentiality, integrity, and availability at the local scope (VC:L, VI:L, VA:L), suggesting the injected commands execute within limited privilege context rather than with root access. EPSS data is unavailable to assess exploitation probability against deployed systems. However, the existence of publicly available exploit code (E:P status) combined with command injection severity suggests this could be weaponized post-authentication by network administrators or compromised user accounts. The low CVSS score reflects the authentication gate; without valid credentials, exploitation is impossible. This is not a network-wide RCE but a post-authentication privilege or capability escalation within administrative interfaces. Real-world priority depends on credential hygiene and whether user-level accounts can access this CGI handler.

An authenticated user (administrator or delegated user account) with access to the Totolink WA300 web interface crafts a POST request with a malicious webWlanIdx parameter containing shell metacharacters and arbitrary commands (e.g., ; whoami; id). The setWebWlanIdx function processes this parameter without validation and executes the injected commands on the router, allowing the attacker to enumerate system information, modify router configuration, exfiltrate traffic, or establish persistence.