CVE-2026-2167: Totolink WA300 Firmware RCE Vulnerability

CVE-2026-2167 Overview

CVE-2026-2167 is an OS command injection vulnerability affecting the Totolink WA300 wireless access point running firmware version 5.2cu.7112_B20190227. The flaw resides in the setAPNetwork function within /cgi-bin/cstecgi.cgi, where the Ipaddr parameter is passed to a system shell without proper sanitization. An authenticated remote attacker can manipulate this parameter to inject arbitrary operating system commands. Public exploit details are already available, increasing the likelihood of opportunistic attacks against exposed devices.

Critical Impact
Remote attackers with low-privileged credentials can execute arbitrary OS commands on affected Totolink WA300 devices, potentially leading to full device compromise and use of the router as a pivot point into internal networks.

Affected Products

Totolink WA300 hardware device
Totolink WA300 firmware version 5.2cu.7112_B20190227
Deployments exposing the /cgi-bin/cstecgi.cgi management interface

Discovery Timeline

2026-02-08 - CVE-2026-2167 published to the National Vulnerability Database
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-2167

Vulnerability Analysis

The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-78 (OS Command Injection). The defect originates in the setAPNetwork handler exposed through the CGI binary cstecgi.cgi. The handler accepts user-controlled input via the Ipaddr parameter and concatenates it into a shell command without escaping shell metacharacters.

Attackers can append command separators such as ;, &&, or backticks to the Ipaddr value. The injected payload executes with the privileges of the web server process, which on most consumer router firmware runs as root. The EPSS model currently estimates a 0.408% probability of exploitation within 30 days, placing this issue in the 61st percentile of CVEs.

Root Cause

The root cause is the absence of input validation and command sanitization in the setAPNetwork function. The firmware treats the Ipaddr argument as trusted data and passes it directly to a shell interpreter. There is no allowlist enforcement to validate that the value conforms to an IPv4 address format before invocation.

Attack Vector

The attack is performed over the network against the device's HTTP management interface. The attacker submits a crafted POST request to /cgi-bin/cstecgi.cgi invoking the setAPNetwork action with a malicious Ipaddr payload. Low-privileged authentication is required, but default credentials on consumer routers are frequently unchanged. Public exploit information referenced in VulDB submission #752063 and the GitHub CVE issue discussion provides reproduction details.

The vulnerability manifests when shell metacharacters embedded in the Ipaddr parameter break out of the intended command context. Refer to the VulDB advisory #344869 for additional technical context.

Detection Methods for CVE-2026-2167

Indicators of Compromise

HTTP POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters (;, |, &, backticks, $()) within the Ipaddr parameter
Unexpected outbound connections from the router to attacker infrastructure following management interface access
Modification of device configuration files, firewall rules, or DNS settings without administrator action
Presence of unfamiliar processes, cron entries, or persistence mechanisms on the device

Detection Strategies

Inspect web server and CGI access logs for requests targeting setAPNetwork with non-IPv4 characters in Ipaddr
Deploy network intrusion detection signatures matching command injection patterns directed at /cgi-bin/cstecgi.cgi
Baseline normal router management traffic and alert on anomalous request bodies or response sizes

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized SIEM for correlation and retention
Monitor for new or modified administrative sessions originating from untrusted source addresses
Track DNS query patterns from network segments behind WA300 devices to identify command-and-control activity

How to Mitigate CVE-2026-2167

Immediate Actions Required

Restrict access to the WA300 web management interface to trusted management VLANs or specific administrator IP addresses
Disable remote WAN-side administration if it is enabled on affected devices
Rotate all administrative credentials on Totolink WA300 devices and remove default accounts
Audit device configuration for unauthorized changes, persistence, or modified DNS entries

Patch Information

No vendor patch is currently referenced in the NVD entry for CVE-2026-2167. Administrators should monitor the Totolink support site for firmware updates addressing this vulnerability. Until a fix is released, compensating controls are required.

Workarounds

Place WA300 devices behind a firewall that blocks inbound access to the HTTP management interface from untrusted networks
Replace end-of-support or unpatched Totolink WA300 hardware with vendor-supported equipment that receives security updates
Segment IoT and network infrastructure devices onto isolated VLANs with strict egress filtering to limit lateral movement if a device is compromised

bash

# Example firewall rule to restrict access to the router management interface
# Replace 192.0.2.10 with your trusted management workstation IP
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP