The Totolink WA300 router firmware 5.2cu.7112_B20190227 contains a command injection vulnerability in the setLanguageCfg function within the /cgi-bin/cstecgi.cgi POST request handler. By manipulating the langType parameter, an attacker can inject and execute arbitrary commands remotely. This vulnerability requires no user interaction and has a medium CVSS 4.0 base score of 5.3. No vendor advisory or patch is currently available, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption of the router. This could compromise network security and device integrity. However, no known active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the device's management interface and monitor for unusual activity. Avoid exposing the router's administrative interface to untrusted networks. Follow vendor communications for updates on patches or official mitigations.