Security readout for executives and security teams
Plain-English summary
CVE-2026-0641 affects TOTOLINK WA300 firmware 5.2cu.7112_B20190227. A remotely reachable, authenticated attacker may inject operating-system commands through a filename-related parameter in cstecgi.cgi. Public exploit information exists, but the provided sources do not show confirmed active exploitation or a vendor fix.
Executive priority
Treat as a targeted network-device risk. Prioritize inventory and exposure reduction for WA300 devices, especially if administration is reachable beyond trusted networks. Escalate patch decisions after checking TOTOLINK’s official guidance.
Technical view
VulDB describes command injection in cstecgi.cgi, function sub_401510, via manipulation of the UPLOAD_FILENAME argument. The CVSS v2 vector is AV:N/AC:L/Au:S/C:P/I:P/A:P, indicating network access, low complexity, and required authentication. CWE mappings include CWE-74 and CWE-77.
Likely exposure
Exposure is most likely where TOTOLINK WA300 devices run firmware 5.2cu.7112_B20190227 and management interfaces are reachable by untrusted users or networks. Authentication is reportedly required, reducing broad unauthenticated risk but not removing risk from weak credentials or compromised accounts.
Exploitation context
The source bundle states the exploit has been publicly disclosed and may be used, and includes a public GitHub PoC reference. CISA KEV status is false in the provided data, so active exploitation is not confirmed here.
Researcher notes
Evidence is centered on VulDB and a public GitHub advisory/PoC. The affected version is specific, but the provided sources do not confirm patched versions, vendor acknowledgement, or in-the-wild exploitation. Avoid assuming broader TOTOLINK model impact without additional evidence.
Mitigation direction
- Identify TOTOLINK WA300 devices and firmware versions in asset inventory.
- Check TOTOLINK guidance for updated firmware or official mitigations.
- Restrict device administration interfaces to trusted networks or VPN only.
- Remove internet exposure for management interfaces where possible.
- Use strong unique administrator credentials and disable unused accounts.
- Monitor for suspicious access to cstecgi.cgi and upload-related functions.
Validation and detection
- Confirm whether any WA300 runs firmware 5.2cu.7112_B20190227.
- Verify management interfaces are not reachable from the public internet.
- Review authentication logs for unexpected administrative access.
- Inspect web logs for suspicious cstecgi.cgi activity.
- Document compensating controls if no vendor fix is available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-74: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-77: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-0641 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR86.4Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
6.5MediumVector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
Source materials
- CVE List V5 sourceCVE List V5
- VDB-339684 | TOTOLINK WA300 cstecgi.cgi sub_401510 command injectionCVE reference · vdb-entry, technical-description
- VDB-339684 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #732234 | TOTOLINK WA300 V5.2cu.7112_B20190227 Command InjectionCVE reference · third-party-advisory
- https://github.com/JackWesleyy/CVE/blob/main/WA300/TOTOLINK_WA300_RCE.mdCVE reference · related, exploit
- https://www.totolink.net/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.