CVE-2026-7719
Published: 04 May 2026
Summary
CVE-2026-7719 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Notion (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7719 is a buffer overflow vulnerability affecting the Totolink WA300 router on firmware version 5.2cu.7112_B20190227. The issue lies in the loginauth function of the /cgi-bin/cstecgi.cgi file within the POST Request Handler component, where manipulation of the http_host argument triggers the overflow. Associated with CWE-119 and CWE-120, it was published on 2026-05-04 and carries a CVSS v3.1 base score of 9.8.
The vulnerability enables remote exploitation with no authentication requirements, low complexity, and no user interaction. Attackers can achieve high confidentiality, integrity, and availability impacts, potentially leading to full device compromise. A public exploit has been released, facilitating attacks against exposed devices.
Advisories referenced in VulDB entries (including vulnerability details and CTI) and a Notion site provide technical analysis, while the Totolink vendor site is listed for further information. No specific patches or mitigations are detailed in the disclosure.
The public availability of the exploit heightens the risk of real-world exploitation against unpatched Totolink WA300 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26870
Vulnerability details
A security flaw has been discovered in Totolink WA300 5.2cu.7112_B20190227. The affected element is the function loginauth of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument http_host results in buffer overflow. The attack may…
more
be launched remotely. The exploit has been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in unauthenticated public CGI endpoint (/cgi-bin/cstecgi.cgi) directly enables remote code execution against an Internet-facing router web application, mapping to T1190 Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of the http_host argument in POST requests to the loginauth function, directly preventing the buffer overflow manipulation.
Implements memory protections such as stack canaries, ASLR, and DEP to mitigate exploitation of the buffer overflow vulnerability.
Requires monitoring for and timely remediation of the specific buffer overflow flaw via firmware patching.