CVE-2026-7718

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability was identified in Totolink WA300 5.2cu.7112_B20190227. Impacted is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument webWlanIdx leads to command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: May 4, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-771808.3When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NG CVE-2026-771819.8Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the re CVE-2026-771838.8The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all ve CVE-2026-771845.2In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL r CVE-2026-771859.1Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way t CVE-2026-771866.4The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attrib CVE-2026-771876.4The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortc CVE-2026-771896.5The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulne CVE-2026-77199.8A security flaw has been discovered in Totolink WA300 5.2cu.7112_B20190227. The affected element is the function loginauth of the file /cgi-CVE-2026-771906.5On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device CVE-2026-771912.6An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a b CVE-2026-771937.5The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via