PT-2026-1502 · Totolink · Totolink Wa300

Jackwesley · Publicado 2026-01-06 · Atualizado 2026-01-22 · CVE-2026-0641

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK WA300 version 5.2cu.7112 B20190227

Description A security issue exists in TOTOLINK WA300 version 5.2cu.7112 B20190227. The sub 401510 function within the cstecgi.cgi file is susceptible to command injection through manipulation of the UPLOAD FILENAME argument. This allows for remote exploitation. The exploit for this issue has been publicly disclosed.

Recommendations Apply a newer version of the software that addresses this vulnerability. As a temporary workaround, restrict access to the cstecgi.cgi file or disable the sub 401510 function until a patch is available. Avoid using the UPLOAD FILENAME parameter in the affected file.

Exploit

Correção

Special Elements Injection

Command Injection

Enumeração de Fraquezas

CWE-74

CWE-77

Identificadores relacionados

CVE-2026-0641

Produtos afetados

Totolink Wa300

Referências · 12

• 🔥 https://github.com/JackWesleyy/CVE/blob/main/WA300/TOTOLINK_WA300_RCE.md · Exploit
• 🔥 https://github.com/JackWesleyy/CVE/blob/main/WA300/TOTOLINK_WA300_RCE.md#poc · Exploit
• https://vuldb.com/?ctiid.339684 · Nota
• https://vuldb.com/?submit.732234 · Nota
• https://totolink.net · Nota
• https://twitter.com/CVEnew/status/2008618203606343756 · Publicação no Twitter
• https://t.me/cveNotify/149585 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2008732592170824055 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-0641 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-0641 · Nota de Segurança
• https://vuldb.com/?id.339684 · Nota
• https://t.me/CVEtracker/41522 · Publicação no Telegram