Medium severity · published May 4, 2026
CVE-2026-7720
Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection
6.3
CVSS
1%
EPSS
No
On KEV
Description
A weakness has been identified in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. This manipulation of the argument langType causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WA300 · Totolink
5.2cu.7112_B20190227 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7720
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7720
lavender-bicycle-a5a.notion.site
https://lavender-bicycle-a5a.notion.site/TOTOLINK-WA300-setLanguageCfg-34553a41781f8007b6c5c7964d424286
vuldb.com
https://vuldb.com/submit/807198
vuldb.com
https://vuldb.com/vuln/360896
vuldb.com
https://vuldb.com/vuln/360896/cti
www.totolink.net
https://www.totolink.net/
More from WA300
9.8
CVE-2026-7719
Totolink WA300 POST Request cstecgi.cgi loginauth buffer overflow
9.8
CVE-2026-4497
Totolink WA300 cstecgi.cgi recvUpgradeNewFw os command injection
8.8
CVE-2026-7717
Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow
8.8
CVE-2026-2167
Totolink WA300 cstecgi.cgi setAPNetwork os command injection
8.8
CVE-2026-0641
TOTOLINK WA300 cstecgi.cgi sub_401510 command injection