Threats tagged 'ghsa-h38g-3gh9-c2c8'

A command injection vulnerability exists in the Totolink WA300 firmware version 5.2cu.7112_B20190227. The flaw is in the setLanguageCfg function of the /cgi-bin/cstecgi.cgi POST request handler, allowing remote attackers with limited privileges to execute arbitrary commands. Public exploit code is available, increasing the risk of exploitation. The vulnerability has a CVSS score of 6.3, indicating medium severity.