This vulnerability involves a buffer overflow in the UploadCustomModule function of the /cgi-bin/cstecgi.cgi component in Totolink WA300 firmware version 5.2cu.7112_B20190227. The flaw arises from improper handling of the File argument in a POST request, allowing remote attackers to trigger a buffer overflow condition. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 8.7, indicating high severity. Although publicly disclosed, no official patch or vendor advisory is currently available, and no known active exploitation has been reported.

Successful exploitation of this buffer overflow could allow remote attackers to cause a denial of service or potentially execute arbitrary code on the affected device. The vulnerability impacts the device's POST request handler, which is accessible remotely, increasing the risk of exploitation. However, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting remote access to the affected device's management interface and monitor for any updates from Totolink regarding patches or mitigations.