CVE-2026-7719
Published: 04 May 2026
Description
A security flaw has been discovered in Totolink WA300 5.2cu.7112_B20190227. The affected element is the function loginauth of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument http_host results in buffer overflow. The attack may…
more
be launched remotely. The exploit has been released to the public and may be used for attacks.
Mitigating Controls (NIST 800-53 r5)AI
Enforces validation of the http_host argument in POST requests to the loginauth function, directly preventing the buffer overflow manipulation.
Implements memory protections such as stack canaries, ASLR, and DEP to mitigate exploitation of the buffer overflow vulnerability.
Requires monitoring for and timely remediation of the specific buffer overflow flaw via firmware patching.
Security SummaryAI
CVE-2026-7719 is a buffer overflow vulnerability affecting the Totolink WA300 router on firmware version 5.2cu.7112_B20190227. The issue lies in the loginauth function of the /cgi-bin/cstecgi.cgi file within the POST Request Handler component, where manipulation of the http_host argument triggers the overflow. Associated with CWE-119 and CWE-120, it was published on 2026-05-04 and carries a CVSS v3.1 base score of 9.8.
The vulnerability enables remote exploitation with no authentication requirements, low complexity, and no user interaction. Attackers can achieve high confidentiality, integrity, and availability impacts, potentially leading to full device compromise. A public exploit has been released, facilitating attacks against exposed devices.
Advisories referenced in VulDB entries (including vulnerability details and CTI) and a Notion site provide technical analysis, while the Totolink vendor site is listed for further information. No specific patches or mitigations are detailed in the disclosure.
The public availability of the exploit heightens the risk of real-world exploitation against unpatched Totolink WA300 devices.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in unauthenticated public CGI endpoint (/cgi-bin/cstecgi.cgi) directly enables remote code execution against an Internet-facing router web application, mapping to T1190 Exploit Public-Facing Application.