CVE-2026-4497: Totolink WA300 cstecgi.cgi recvUpgradeNewFw os command injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-20 · updated 2026-06-17
Weakness: CWE-77

Description

A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. Affected by this issue is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi. This manipulation causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Affected products

Totolink WA300: 5.2cu.7112_b20190227

References

https://github.com/hellonestor/killallbug/issues/1
https://github.com/user-attachments/files/25790616/Unauthenticated.Remote.Code.Execution.in.TOTOLINK.WA300.via.Command.Injection.in.recvUpgradeNewFw.zip
https://vuldb.com/?ctiid.352046
https://vuldb.com/?id.352046
https://vuldb.com/?submit.773875
https://www.totolink.net/

Get alerted when CVE-2026-4497 or the next vulnerability affects your stack