CVE Intelligence
Analysis AI-assisted

CVE-2026-7719: Totolink WA300 Buffer Overflow in loginauth via cstecgi.cgi

CVE-2026-7719 is a buffer overflow (CWE-119) in the loginauth function of the POST Request Handler component of Totolink WA300 firmware 5.2cu.7112_B20190227. The CNA rates it critical (CVSS 3.1 score 9.8) and states it can be triggered remotely, and that an exploit has been published. The record does not show KEV listing or confirmed exploitation in the wild.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a buffer overflow (CWE-119) in the loginauth function, reached through /cgi-bin/cstecgi.cgi in the POST Request Handler component of the Totolink WA300 (firmware string 5.2cu.7112_B20190227). According to the record, manipulation of the http_host argument causes the overflow and the attack may be launched remotely.

Impact

  • The CNA's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network access, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact. The base score is 9.8 (critical).
  • Buffer overflows of this type can in general lead to crashes or arbitrary code execution. The sources consulted do not state the specific outcome for this flaw, so this remains an inference.

Affected products and versions

  • Product: Totolink WA300, version string 5.2cu.7112_B20190227.
  • The record's structured affected and fixed version lists are empty. Affected scope beyond the listed firmware string is unknown.
  • The vendor website is listed as a reference, but no vendor advisory is included in the record.

Exploitation status

  • The CISA KEV catalog does not list this CVE.
  • The record states that an exploit has been publicly released and may be used for attacks. No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability is 0.0102 (about 1.02%) with a percentile of 0.62466, dated 2026-10-13.

Remediation and mitigation

  • Inventory WA300 devices and confirm whether any run the listed firmware string.
  • Check the vendor's support channels for a firmware update. The record does not provide a fixed version, so a fix's existence is unknown.
  • Do not expose the device's web management interface to the internet. Limit it to trusted administrative networks and segment IoT and router management traffic.
  • If no supported fix is available, plan replacement or decommissioning of the device (inference based on the critical rating and public exploit).

Detection guidance

  • Review web server and device logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially from unknown or external sources.
  • Watch for unexplained device reboots, crashes or service restarts, which can indicate abnormal input handling.
  • Alert on any management-plane access originating outside approved administrative networks.

Limitations of the available information

  • The analysis is based on one record. No vendor advisory, patch, or affected version range beyond the single firmware string was available.
  • The record's source status is Deferred, and the CVSS scores come from the CNA (VulDB).
  • The CVSS 4.0 (8.9) and 2.0 (10) scores are reported by the CNA, but no NVD-assigned scores are present in the record.
  • Whether the exploit's effects go beyond a crash is not established in the sources consulted.

Frequently asked questions

Is CVE-2026-7719 being actively exploited?

The CVE is not listed in CISA KEV. The record says a public exploit exists, but no confirmed exploitation in the wild appears in the sources consulted.

Which devices are affected?

The record names the Totolink WA300 with firmware string 5.2cu.7112_B20190227. No broader affected version range or fixed version is provided.

Can it be exploited remotely?

The CNA's CVSS 3.1 vector marks the attack vector as network, with no privileges or user interaction required.

What should administrators do now?

Inventory affected devices, check the vendor for firmware updates, restrict management interface exposure, and monitor logs. If no fix exists, consider replacing the device.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.