Totolink WA300 EUVD-2026-26870

Exploitation requires the Totolink WA300 device web management interface to be network-accessible to the attacker, either exposed to the internet or reachable from the attacker's network position. The vulnerability exists in the pre-authentication code path of the loginauth function, meaning no valid credentials are required and the attack succeeds against default configurations with web management enabled. The CGI handler /cgi-bin/cstecgi.cgi must be accessible and processing HTTP POST requests, which is the standard operational state for devices with active web-based administration. No user interaction is required as this is a server-side vulnerability in automatic request processing. The specific firmware version 5.2cu.7112_B20190227 must be installed, though testing of adjacent firmware versions is recommended as similar code may exist across the product line. Successful exploitation depends on ASLR/DEP protections being absent or bypassable in this embedded Linux environment, typical for SOHO router firmware from this era.

This vulnerability presents high practical risk despite absence from CISA KEV. The CVSS 4.0 score of 8.9 with vector AV:N/AC:L/PR:N/UI:N accurately reflects severe risk: network-reachable, low complexity, no authentication required, and no user interaction needed. The Exploit Maturity indicator E:P (Proof-of-concept) confirms publicly available exploit code exists, significantly lowering the skill barrier for exploitation. The Notion-hosted technical writeup provides attackers with implementation details for weaponization. However, real-world risk is tempered by the limited deployment scope of Totolink WA300 devices compared to enterprise infrastructure, suggesting targeted rather than mass exploitation scenarios. The lack of CISA KEV listing despite public POC availability indicates no confirmed widespread exploitation campaigns as of analysis date, though small office/home office (SOHO) deployments remain vulnerable. SSVC framework assessment: Exploitation=POC, Automatable=Yes (no auth/interaction barriers), Technical Impact=Total (arbitrary code execution). Priority should be immediate for organizations using affected devices, though enterprise exposure is likely minimal given the consumer-grade product category.

An external attacker scans internet-facing IP ranges identifying Totolink WA300 devices by fingerprinting their web management interfaces on standard HTTP/HTTPS ports. Using the publicly available exploit code from the Notion documentation, the attacker crafts a malicious HTTP POST request to /cgi-bin/cstecgi.cgi with an oversized http_host parameter containing shellcode. The loginauth function processes this request pre-authentication, triggering the buffer overflow that overwrites the stack return address with attacker-controlled values, redirecting execution to injected shellcode that establishes a reverse shell with root-level device privileges, enabling firmware modification, traffic interception, or pivoting into the internal network.