This vulnerability involves a buffer overflow in the loginauth function of the /cgi-bin/cstecgi.cgi component of Totolink WA300 firmware version 5.2cu.7112_B20190227. The issue arises from improper processing of the http_host argument in POST requests, allowing remote attackers to cause a buffer overflow. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. An exploit has been publicly disclosed, increasing the risk of attacks.

Successful exploitation of this buffer overflow vulnerability could allow remote attackers to execute arbitrary code or cause denial of service on affected devices without any authentication or user interaction. The critical CVSS score reflects the potential for complete compromise of the device. However, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround has been published, users should monitor Totolink's official channels for updates. Until a fix is available, restricting access to the device's management interface from untrusted networks may reduce exposure.