Is there a public PoC exploit available for CVE-2026-7718?

Yes, a public proof-of-concept exploit is available for CVE-2026-7718. Prioritise patching immediately. EPSS: 2.3%.

Totolink WA300 CVE-2026-7718

Q: What is the CVSS score of CVE-2026-7718?

CVE-2026-7718 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.3%.

EUVD-2026-26869 LOW

Command Injection (CWE-77)

2026-05-04 VulDB

Command Injection Wa300

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 04, 2026 - 15:18 vuln.today

Public exploit code

Analysis Generated

May 04, 2026 - 02:30 vuln.today

Severity Changed

May 04, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

May 04, 2026 - 02:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

May 04, 2026 - 02:15 euvd

EUVD-2026-26869

Analysis Generated

May 04, 2026 - 02:15 vuln.today

CVE Published

May 04, 2026 - 01:15 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was identified in Totolink WA300 5.2cu.7112_B20190227. Impacted is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument webWlanIdx leads to command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

Command injection in Totolink WA300 firmware version 5.2cu.7112_B20190227 allows authenticated remote attackers to execute arbitrary commands via the webWlanIdx parameter in the setWebWlanIdx function of /cgi-bin/cstecgi.cgi. The vulnerability requires valid user credentials but no user interaction, with publicly available exploit code demonstrating the attack.

Technical ContextAI

The vulnerability exists in the POST request handler for the WA300 wireless router's web administrative interface. The setWebWlanIdx function in cstecgi.cgi fails to properly validate or sanitize the webWlanIdx parameter before passing it to a command execution context, enabling OS command injection (CWE-77). The affected component is part of the router's WLAN configuration management exposed through a CGI script accessible via HTTP/HTTPS on the administrative interface.

RemediationAI

Upgrade firmware to a patched version released by Totolink after the vulnerable 5.2cu.7112_B20190227 build. Check the Totolink official website (www.totolink.net) for the latest WA300 firmware release and apply it immediately to all affected devices. If a patched version is not yet available, implement compensating controls: restrict administrative web interface access to trusted IP addresses or VLANs only, disable remote management if not required, enforce strong authentication credentials and change default administrative passwords, and monitor CGI logs for suspicious webWlanIdx parameter values. These controls reduce but do not eliminate the risk since authenticated local users or compromised accounts can still exploit the flaw. Note that network-level filtering of the /cgi-bin/cstecgi.cgi endpoint may disrupt legitimate WLAN configuration management.