Totolink WA300 EUVD-2026-26873

Exploitation requires an authenticated user account on the Totolink WA300 router. The attacker must either possess legitimate administrator credentials or exploit a separate vulnerability to gain authenticated access to the web interface. The POST request handler must be active (default configuration). No additional special configuration is required - the vulnerable setLanguageCfg function is present in the standard firmware. The vulnerability is limited to authenticated attackers and cannot be triggered remotely by unauthenticated users, which is the primary limiting factor reducing practical attack surface.

This vulnerability presents a low-to-moderate real-world risk despite public exploit availability. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible remote exploitation requiring low privilege (authenticated) user access. The low CVSS score of 2.1 reflects intentionally limited impact scope in the vector (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N), meaning the vulnerability cannot escalate to system-wide compromise of confidentiality, integrity, or availability - it is constrained to low-impact user-level access. The E:P flag indicates publicly available exploit code. However, the authentication requirement (PR:L) is a significant friction point in attack scenarios; attackers must obtain legitimate user credentials or exploit a separate vulnerability to gain authenticated access first. The exploitation probability is thus conditioned on prior access rather than unauthenticated network exposure. For organizations where router admin interfaces are properly access-controlled (e.g., not exposed to untrusted networks), the practical risk is contained. Organizations with weak credential hygiene or exposed administrative interfaces face elevated risk.

An authenticated user (or attacker with stolen credentials) sends a crafted POST request to the router's /cgi-bin/cstecgi.cgi endpoint with a malicious langType parameter containing OS command syntax (e.g., 'en; cat /etc/passwd'). The setLanguageCfg function concatenates this unsanitized input into a shell command executed with the router's process privileges, allowing command execution in the router's system context. The attacker retrieves sensitive configuration data, modifies router settings, or establishes persistence.