CVE-2026-2167

2.1 lowEPSS 2.6%

Low (2.1) in totolink wa300 firmware. EPSS 2.6% chance of exploitation in the next 30 days.

A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Ipaddr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWEs: CWE-78, CWE-77
Published: 2026-02-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

totolink:wa300_firmware

References

https://github.com/master-abc/cve/issues/36
https://vuldb.com/?ctiid.344869
https://vuldb.com/?id.344869
https://vuldb.com/?submit.752063
https://www.totolink.net/

Check your stack JSON