This vulnerability involves a buffer overflow in the UploadCustomModule function of the /cgi-bin/cstecgi.cgi component in Totolink WA300 firmware version 5.2cu.7112_B20190227. The issue arises from improper handling of the File argument in a POST request, allowing remote attackers to trigger a buffer overflow condition. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but lacks an official fix or patch from the vendor as of the published date.

Successful exploitation of this buffer overflow vulnerability could allow remote attackers to cause a denial of service or potentially execute arbitrary code on the affected device. Given the high CVSS score and the nature of buffer overflows, the impact could be significant, affecting device stability and security. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor Totolink's official channels for updates. Until a patch is released, limiting network exposure of the affected device and restricting access to the management interface may reduce risk.