Totolink · Wa300 · CVE-2026-7717
**Name of the Vulnerable Software and Affected Versions**
Totolink WA300 version 5.2cu.7112 B20190227
**Description**
A buffer overflow exists in the POST Request Handler component. This issue occurs within the `UploadCustomModule()` function of the '/cgi-bin/cstecgi.cgi' endpoint. A remote, unauthenticated attacker can trigger this flaw by manipulating the `File` argument via a malformed POST request, potentially leading to remote code execution.
**Recommendations**
For version 5.2cu.7112 B20190227, update the firmware to a newer version to mitigate the risk.
As a temporary workaround, restrict access to the '/cgi-bin/cstecgi.cgi' endpoint to minimize the risk of exploitation.