CVE-2026-4497
OS Command Injection in Totolink WA300 recvUpgradeNewFw Function
Publication date: 2026-03-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | wa300_firmware | 5.2cu.7112_b20190227 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-4497 is a vulnerability in the TOTOLINK WA300 router, specifically in the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi. This vulnerability allows an attacker to perform OS command injection remotely without any authentication.
Because of this flaw, an attacker can execute arbitrary commands on the device, potentially gaining full control over the router.
How can this vulnerability impact me? :
This vulnerability can have serious impacts as it allows remote attackers to execute arbitrary commands on the affected router without authentication.
An attacker exploiting this issue could gain full control over the router, which may lead to network compromise, interception of data, disruption of network services, or use of the device as a foothold for further attacks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability in Totolink WA300 involves a command injection flaw in the recvUpgradeNewFw function, which can be exploited remotely without authentication.
However, no specific detection commands or network/system scanning techniques are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
There are no explicit mitigation steps or patches mentioned in the provided information.
Given the nature of the vulnerability (remote command injection without authentication), immediate general mitigation steps would typically include restricting access to the affected device, disabling vulnerable services if possible, and monitoring for suspicious activity.
Since the exploit has been publicly disclosed, it is advisable to check for official firmware updates from the vendor or apply network-level protections such as firewall rules to limit exposure.