The Totolink WA300 router firmware version 5.2cu.7112_B20190227 contains a command injection vulnerability in the setWebWlanIdx function of the /cgi-bin/cstecgi.cgi POST request handler. By manipulating the webWlanIdx parameter, an attacker can remotely execute arbitrary commands on the device. This vulnerability allows for remote code execution with low attack complexity and no user interaction required. The CVSS 4.0 base score is 5.3, indicating medium severity. No official patch or vendor remediation level has been disclosed. Public exploits exist but no confirmed exploitation in the wild is reported.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the affected Totolink WA300 device remotely. This could lead to unauthorized control over the device, potentially impacting network security and device integrity. However, the impact is rated medium severity and no known active exploitation has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting remote access to the device's management interface and monitoring for suspicious activity related to the /cgi-bin/cstecgi.cgi endpoint. Avoid exposing the device management interface to untrusted networks.