CVE-2026-4497 is a high severity OS command injection (CVSS 7.3) in the TOTOLINK WA300 firmware 5.2cu.7112_B20190227. The recvUpgradeNewFw function in cstecgi.cgi can be abused remotely, and the record says the exploit is public. No fixed firmware is confirmed, so check the vendor.
What's affected
From the record:
- Affected: TOTOLINK WA300, firmware 5.2cu.7112_B20190227.
- Fixed: no fixed firmware is confirmed in the sources I checked. Check the vendor site (totolink.net) for updates.
The vulnerable code is the function recvUpgradeNewFw in /cgi-bin/cstecgi.cgi. The public report describes it as reachable without authentication. The record rates privileges required as none.
How to check if you're exposed
Open the device's administration page and read the firmware version on the status or system page. If it matches the version above, treat the device as affected.
From a host outside your network, check whether the router's web interface answers on its public address. Also check your router or firewall for port forwards to the device.
What to do now
- Check the TOTOLINK site for newer firmware, and install it if one exists.
- Do not expose the administration interface to the internet, and turn off remote management.
- Place the device on a network where untrusted hosts cannot reach its web interface.
- If no fix appears and the device is exposed, replace it with a supported model.
Why it matters
The record lists CWE-78 (OS command injection) and CWE-77 (command injection). A function that handles firmware upgrade input passes request data into a shell command without cleaning it, so crafted input can add its own commands.
Small office network devices often run old firmware for years, and a public exploit makes them easy targets. The record does not mark this CVE as KEV, and I did not find confirmation of exploitation in the wild. Treat the public exploit as a reason to act quickly on exposed devices.
Quick check
Is there a patch?
None is confirmed in the sources I checked. Check the vendor site, and replace the device if it stays unsupported.
Sources
Last reviewed: 19 October 2026.
