Totolink WA300 EUVD-2026-26874

Exploitation requires valid authentication credentials (PR:L) for the device management interface - the attacker must log into the Totolink WA300 web administration panel or possess valid credentials for the CGI endpoint. The NTPSyncWithHost function must be invoked, typically through the device's NTP configuration interface. The hostTime parameter must accept and process user input without validation. Exploitation is NOT possible against unauthenticated sessions or default (non-configured) device states. The command execution occurs within the CGI application context (VC:L/VI:L/VA:L), not as a privileged system user, limiting the scope of achievable impact compared to kernel-level code execution.

Despite the CVSS v4.0 score of 2.1 (low), this vulnerability presents moderate contextual risk due to contradictory signals. The CVSS vector shows AV:N (network-accessible) and AC:L (low complexity), but requires PR:L (low-privilege authentication), which substantially restricts the threat surface - an attacker must already possess valid device credentials. The E:P (Exploit Proof-of-Concept) indicator confirms publicly available exploit code exists, increasing risk for organizations with weak access controls or default credentials. However, the VC:L/VI:L/VA:L scope limitation indicates exploited commands execute within the CGI application context rather than achieving system-level code execution as root, further limiting impact. The critical mitigating factor is the authentication requirement: this is not an unauthenticated remote code execution vulnerability despite the network vector. For organizations with properly secured device administration interfaces and no default credentials, real-world risk remains low. For organizations with weak authentication (shared credentials, default settings), risk escalates to moderate due to command injection impact on device functionality and potential lateral movement if the device sits between trusted network segments.

An authenticated attacker (such as a user with device administration credentials obtained through credential compromise or weak default passwords) sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with a malicious hostTime parameter containing shell metacharacters (e.g., ; cat /etc/config). The CGI script processes this unsanitized input directly into an OS command, executing the injected payload and exfiltrating configuration files or modifying device settings. The publicly available POC demonstrates the precise syntax required to trigger this flaw.