Threats tagged 'ghsa-6w4f-g875-v59m'

A command injection vulnerability exists in the Totolink WA300 firmware version 5.2cu.7112_B20190227, specifically in the NTPSyncWithHost function of /cgi-bin/cstecgi.cgi. This flaw allows remote attackers with low privileges to manipulate the hostTime argument to execute arbitrary commands. The vulnerability has a medium severity rating with a CVSS score of 6.3. Public exploit details have been disclosed, but no known active exploitation in the wild has been reported. No patch or remediation information is currently available.