PT-2026-1502 · Totolink · Totolink Wa300

Jackwesley · Published 2026-01-06 · Updated 2026-01-22 · CVE-2026-0641

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK WA300 version 5.2cu.7112 B20190227

Description A security issue exists in TOTOLINK WA300 version 5.2cu.7112 B20190227. The sub 401510 function within the cstecgi.cgi file is susceptible to command injection through manipulation of the UPLOAD FILENAME argument. This allows for remote exploitation. The exploit for this issue has been publicly disclosed.

Recommendations Apply a newer version of the software that addresses this vulnerability. As a temporary workaround, restrict access to the cstecgi.cgi file or disable the sub 401510 function until a patch is available. Avoid using the UPLOAD FILENAME parameter in the affected file.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-0641

Affected Products

Totolink Wa300

References · 12

• 🔥 https://github.com/JackWesleyy/CVE/blob/main/WA300/TOTOLINK_WA300_RCE.md · Exploit
• 🔥 https://github.com/JackWesleyy/CVE/blob/main/WA300/TOTOLINK_WA300_RCE.md#poc · Exploit
• https://osv.dev/vulnerability/CVE-2026-0641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0641 · Security Note
• https://vuldb.com/?ctiid.339684 · Note
• https://vuldb.com/?submit.732234 · Note
• https://totolink.net · Note
• https://twitter.com/CVEnew/status/2008618203606343756 · Twitter Post
• https://t.me/cveNotify/149585 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2008732592170824055 · Twitter Post
• https://vuldb.com/?id.339684 · Note
• https://t.me/CVEtracker/41522 · Telegram Post