PT-2026-6998 · Totolink · Totolink Wa300

Jiefengliang · Published 2026-02-04 · Updated 2026-02-08 · CVE-2026-2167

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Totolink WA300 version 5.2cu.7112 B20190227

Description A flaw exists in the Totolink WA300 device that allows for remote command execution. This is due to a vulnerability within the setAPNetwork function located in the /cgi-bin/cstecgi.cgi file. Specifically, manipulating the Ipaddr argument can lead to operating system command injection. The exploit for this issue is publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2026-02478

CVE-2026-2167

Affected Products

Totolink Wa300

References · 11

• 🔥 https://github.com/master-abc/cve/issues/36 · Exploit
• https://osv.dev/vulnerability/CVE-2026-2167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2167 · Security Note
• https://bdu.fstec.ru/vul/2026-02478 · Security Note
• https://vuldb.com/?ctiid.344869 · Note
• https://vuldb.com/?submit.752063 · Note
• https://totolink.net · Note
• https://t.me/CVEtracker/44116 · Telegram Post
• https://vuldb.com/?id.344869 · Note
• https://t.me/cveNotify/151314 · Telegram Post
• https://twitter.com/CVEnew/status/2020549127159840964 · Twitter Post