Threats tagged 'ghsa-7ww3-945v-369q'

A command injection vulnerability exists in the Totolink WA300 firmware version 5.2cu.7112_B20190227. The flaw is in the setWebWlanIdx function of the /cgi-bin/cstecgi.cgi POST request handler, allowing remote attackers with limited privileges to execute arbitrary commands by manipulating the webWlanIdx argument. Public exploit code is available. The vulnerability has a medium severity rating with a CVSS score of 6.3.