CVE-2026-2167
📋 TL;DR
This CVE describes a remote command injection vulnerability in Totolink WA300 routers. Attackers can execute arbitrary operating system commands by manipulating the Ipaddr parameter in the setAPNetwork function. All users of affected Totolink WA300 router versions are vulnerable to remote exploitation.
💻 Affected Systems
- Totolink WA300 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full router compromise allowing attacker to install persistent backdoors, intercept all network traffic, pivot to internal networks, and brick the device.
Likely Case
Router takeover leading to network traffic interception, DNS hijacking, credential theft, and lateral movement to connected devices.
If Mitigated
Limited impact if device is behind strict firewall rules, but still vulnerable to internal attackers or if perimeter controls fail.
🎯 Exploit Status
Public exploit code exists on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.totolink.net/
Restart Required: Yes
Instructions:
1. Check Totolink website for firmware updates. 2. Download latest firmware for WA300 model. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload new firmware file. 6. Wait for reboot and verify version.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router management interface
Access router admin > Advanced > Remote Management > Disable
Network Segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Implement strict firewall rules blocking all external access to router management ports (80, 443, 8080)
- Deploy network-based intrusion prevention system (IPS) with command injection detection rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version matches 5.2cu.7112_B20190227 or similar, assume vulnerable.Check Version:
curl -s http://router-ip/cgi-bin/cstecgi.cgi | grep version OR check web admin interfaceVerify Fix Applied:
Verify firmware version has been updated to a version after the vulnerable release. Test management interface for command injection attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/cstecgi.cgi with shell metacharacters in parameters
- Multiple failed login attempts followed by successful command execution patterns
Network Indicators:
- HTTP requests containing shell commands (;, |, &, $, etc.) in URL parameters
- Unusual outbound connections from router to external IPs
SIEM Query:
source="router_logs" AND uri="/cgi-bin/cstecgi.cgi" AND (param="Ipaddr" AND value MATCHES "[;&|`$()]+")