CVE-2026-7717
Published: 04 May 2026
Summary
CVE-2026-7717 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Notion (inferred from references). Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 37.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7717 is a buffer overflow vulnerability affecting the Totolink WA300 router on firmware version 5.2cu.7112_B20190227. The flaw exists in the UploadCustomModule function within the /cgi-bin/cstecgi.cgi file, which is part of the POST Request Handler component. It is triggered by manipulating the File argument in a request.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), associated with CWE-119 and CWE-120. A remote attacker with low privileges can exploit it over the network with low attack complexity and no user interaction. Successful exploitation results in high impacts to confidentiality, integrity, and availability, enabling potential remote code execution.
Advisories and references, including a Notion site detailing the exploit, VulDB entries (vuln/360893 and related CTI/submit pages), and the Totolink vendor site, confirm the issue was published on 2026-05-04. The exploit has been publicly disclosed and may be utilized, though no specific patch or mitigation steps are detailed in the provided information.
The vulnerability's public exploit disclosure increases the risk of active exploitation against unpatched Totolink WA300 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26868
Vulnerability details
A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Executing a manipulation of the argument File can lead to buffer overflow. The attack can be…
more
launched remotely. The exploit has been publicly disclosed and may be utilized.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in authenticated web CGI handler (UploadCustomModule) on network-exposed router enables RCE from low-priv credentials, directly mapping to authenticated exploitation for privilege escalation (T1068) and exploitation of public-facing applications (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely remediation of identified flaws, directly addressing the buffer overflow in the UploadCustomModule function by applying patches or firmware updates.
SI-10 enforces input validation at entry points like the File argument in POST requests to /cgi-bin/cstecgi.cgi, preventing buffer overflow exploitation.
SI-16 implements memory protections such as ASLR and DEP that mitigate exploitation of the buffer overflow vulnerability for remote code execution.