The vulnerability CVE-2026-7719 affects Totolink WA300 firmware version 5.2cu.7112_B20190227. It is a buffer overflow in the loginauth function of the POST request handler located in /cgi-bin/cstecgi.cgi. The issue arises from improper handling of the http_host argument, allowing an attacker to remotely trigger a buffer overflow condition. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided by the vendor, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. The critical CVSS score reflects the high potential impact on confidentiality, integrity, and availability. The vulnerability can be exploited without authentication or user interaction, increasing the risk of remote compromise. Although an exploit is publicly available, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure of the affected device to untrusted networks and monitor for unusual activity. No vendor advisory or official remediation instructions are currently available, so no definitive mitigation steps can be recommended beyond standard risk reduction.