CVE-2026-7719 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-120** (Buffer Copy without Checking Size of Input). 🔍 **Flaw**: The POST request handler fails to validate the length of the `http_host` input before copying it, leading to memory corruption.

Q: Who is affected? (Versions/Components)

📦 **Affected Product**: **Totolink WA300**. 📅 **Specific Version**: Firmware **5.2cu.7112_B20190227**. ⚠️ **Component**: The CGI binary handling login authentication.

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: **LOW**. 🌐 **Auth**: **None Required** (PR:N). 📡 **Access**: **Network** (AV:N). 👀 **UI**: **None Required** (UI:N). ✅ **AC**: **Low** (AC:L). Easy to exploit remotely.

Q: Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exploit**: **YES**. 📢 **Status**: Exploit code has been **publicly released**. ⚡ **Risk**: Active wild exploitation is highly probable given the low barrier to entry.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: **Immediate Action Required**. 📉 **Reason**: Remote, unauthenticated, public exploit, and high CVSS score. Do not wait for a patch if isolation is possible.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A critical **Buffer Overflow** in the `loginauth` function of `/cgi-bin/cstecgi.cgi`.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-120** (Buffer Copy without Checking Size of Input). <br>🔍 **Flaw**: The POST request handler fails to validate the length of the `http_host` input before copying it, leading to memory corruption.

Q3Who is affected? (Versions/Components)

📦 **Affected Product**: **Totolink WA300**. <br>📅 **Specific Version**: Firmware **5.2cu.7112_B20190227**. <br>⚠️ **Component**: The CGI binary handling login authentication.

Q4What can hackers do? (Privileges/Data)

👑 **Privileges**: High. The CVSS score indicates **Complete** impact on Confidentiality, Integrity, and Availability.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: **LOW**. <br>🌐 **Auth**: **None Required** (PR:N). <br>📡 **Access**: **Network** (AV:N). <br>👀 **UI**: **None Required** (UI:N). <br>✅ **AC**: **Low** (AC:L). Easy to exploit remotely.

Q6Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exploit**: **YES**. <br>📢 **Status**: Exploit code has been **publicly released**. <br>⚡ **Risk**: Active wild exploitation is highly probable given the low barrier to entry.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for the specific CGI path `/cgi-bin/cstecgi.cgi`. <br>📡 **Target**: Look for POST requests to the `loginauth` endpoint.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: The data does not explicitly confirm a patch release date, but the vendor is **Totolink**.…

Read full answer (login)

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1. **Isolate**: Move the device to a trusted VLAN. <br>2. **Block**: Restrict WAN access to the router's management interface. <br>3.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>🚨 **Priority**: **Immediate Action Required**. <br>📉 **Reason**: Remote, unauthenticated, public exploit, and high CVSS score. Do not wait for a patch if isolation is possible.

Continue exploring

Vulnerability detail Full AI analysis (login) Totolink CWE-120