CVE-2026-2167: Totolink WA300 cstecgi.cgi setAPNetwork os command injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-08 · updated 2026-06-17
Weakness: CWE-77

Description

A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Ipaddr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.

Affected products

Totolink WA300: 5.2cu.7112_b20190227

References

https://github.com/master-abc/cve/issues/36
https://vuldb.com/?ctiid.344869
https://vuldb.com/?id.344869
https://vuldb.com/?submit.752063
https://www.totolink.net/

Get alerted when CVE-2026-2167 or the next vulnerability affects your stack