PT-2026-6998 · Totolink · Totolink Wa300

Jiefengliang · Publicado 2026-02-04 · Atualizado 2026-02-08 · CVE-2026-2167

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Totolink WA300 version 5.2cu.7112 B20190227

Description A flaw exists in the Totolink WA300 device that allows for remote command execution. This is due to a vulnerability within the setAPNetwork function located in the /cgi-bin/cstecgi.cgi file. Specifically, manipulating the Ipaddr argument can lead to operating system command injection. The exploit for this issue is publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

OS Command Injection

Enumeração de Fraquezas

CWE-77

CWE-78

Identificadores relacionados

BDU:2026-02478

CVE-2026-2167

Produtos afetados

Totolink Wa300

Referências · 11

• 🔥 https://github.com/master-abc/cve/issues/36 · Exploit
• https://vuldb.com/?ctiid.344869 · Nota
• https://osv.dev/vulnerability/CVE-2026-2167 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-2167 · Nota de Segurança
• https://vuldb.com/?submit.752063 · Nota
• https://totolink.net · Nota
• https://t.me/CVEtracker/44116 · Publicação no Telegram
• https://vuldb.com/?id.344869 · Nota
• https://t.me/cveNotify/151314 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2020549127159840964 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-02478 · Nota de Segurança