CVE-2026-4497: Totolink WA300 Firmware

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. Affected by this issue is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi. This manipulation causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Affected products

• Totolink WA300 Firmware: version 5.2cu.7112_b20190227 only

Published 2026-03-20. Last modified 2026-06-17.