Is there a public PoC exploit available for CVE-2026-7720?

Yes, a public proof-of-concept exploit is available for CVE-2026-7720. Prioritise patching immediately. EPSS: 2.9%.

Totolink WA300 CVE-2026-7720

Q: What is the CVSS score of CVE-2026-7720?

CVE-2026-7720 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.9%.

EUVD-2026-26873 LOW

Command Injection (CWE-77)

2026-05-04 VulDB

Command Injection Wa300

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 04, 2026 - 15:18 vuln.today

Public exploit code

Analysis Generated

May 04, 2026 - 02:30 vuln.today

Severity Changed

May 04, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

May 04, 2026 - 02:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

May 04, 2026 - 02:15 euvd

EUVD-2026-26873

Analysis Generated

May 04, 2026 - 02:15 vuln.today

CVE Published

May 04, 2026 - 01:45 nvd

LOW 2.1

DescriptionCVE.org

A weakness has been identified in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. This manipulation of the argument langType causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Command injection in Totolink WA300 5.2cu.7112_B20190227 allows authenticated remote attackers to execute arbitrary commands via the langType parameter in the setLanguageCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, though the low CVSS 2.1 score reflects limited scope (only low confidentiality and integrity impact, no system integrity or availability impact) and authentication requirement, reducing real-world attack surface.

Technical ContextAI

The Totolink WA300 is a wireless router that processes POST requests through its CGI handler at /cgi-bin/cstecgi.cgi. The setLanguageCfg function fails to properly sanitize the langType parameter before passing it to system commands, allowing command injection via shell metacharacters. This is a classic CWE-77 (Improper Neutralization of Special Elements used in a Command) vulnerability where user input reaches the OS command execution layer without adequate validation or escaping. The CPE indicates all versions of the WA300 product line are potentially affected, though the specific vulnerable version identified is 5.2cu.7112_B20190227.

RemediationAI

Contact Totolink support for availability of patched firmware for the WA300 line; no specific patch version is confirmed in vendor advisories at time of analysis. As interim mitigations, restrict administrative access to the router's web interface to trusted internal networks only, implement network segmentation to isolate router management interfaces from untrusted segments, disable remote management features if not required, and enforce strong authentication credentials (change default admin passwords immediately). Disable the setLanguageCfg functionality if available through the router's administrative panel, or apply input validation rules at the network perimeter (WAF/IDS rules) to block POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters (pipes, semicolons, backticks, command substitution syntax) in the langType parameter. Monitor Totolink's official website (https://www.totolink.net/) for firmware updates and security advisories.