Totolink WA300 EUVD-2026-26868

Requires valid administrative credentials to the Totolink WA300 web management interface (PR:L in CVSS vector). The vulnerability exists in the UploadCustomModule function accessible via POST requests to /cgi-bin/cstecgi.cgi, which is part of the standard web-based administrative interface enabled by default. No special features need to be activated beyond the normal administrative web interface. Exploitation is limited to networks from which the attacker can reach the device's management interface on TCP port 80 or the configured management port - if remote management is disabled (non-default but recommended configuration), attack surface is reduced to local network only. Default or weak administrative passwords significantly lower the authentication barrier, as credentials for this device class are often left unchanged or easily brute-forced.

Real-world risk is MODERATE to HIGH for deployed devices but limited in scope. CVSS 4.0 score of 7.4 reflects network-accessible exploitation (AV:N), low attack complexity (AC:L), and high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H), but requires low-privilege authentication (PR:L). The E:P (Proof-of-concept) modifier confirms public exploit availability. Critical risk factors: publicly documented exploit with step-by-step instructions exists, enabling script-kiddie level attacks; low attack complexity means exploitation is straightforward once authenticated; network vector allows remote compromise. Mitigating factors: requires authenticated access (PR:L), limiting attack surface to compromised credentials or default/weak passwords; Totolink WA300 is a consumer-grade range extender with limited deployment in enterprise environments; no CISA KEV listing indicates exploitation is not widespread despite POC availability. EPSS data is absent but would likely be low-to-moderate given the authentication requirement and niche product. Priority should be HIGH for organizations using this specific model with exposed management interfaces, LOW for those not using Totolink products. KEY UNCERTAINTY: Vendor has not issued advisory confirming affected versions beyond the single firmware build mentioned, and patch availability is unconfirmed from official sources.

An attacker who has obtained or guessed the administrative credentials for a Totolink WA300 device (default credentials are commonly published online for such devices) sends a crafted HTTP POST request to http://[device-ip]/cgi-bin/cstecgi.cgi with an oversized File parameter to the UploadCustomModule function. The buffer overflow overwrites adjacent memory, allowing the attacker to inject and execute arbitrary code with the privileges of the web server process (typically root on embedded devices), gaining complete control of the range extender to intercept traffic, pivot to connected network devices, or establish persistent backdoor access. Public proof-of-concept code reduces exploitation to copy-paste execution.