CVE-2026-123957
CriticalCVSS 9.9Summary
In TOTOLINK CA300-PoE version 6.2c.884, the setIpQosRules function in /cgi-bin/cstecgi.cgi mishandles the ipStart argument, leading to a buffer overflow. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker could exploit the buffer overflow to destabilize the device or potentially execute code. The public availability of the exploit increases the risk of attack.
Recommendation
Update TOTOLINK CA300-PoE firmware to the latest version or restrict access to the management interface. Until a patch is available, consider isolating the device on the network.
Other vulnerabilities in TOTOLINK CA300-PoE
See all- CVE-2026-123961Critical
A vulnerability was detected in TOTOLINK CA300-PoE version 6.2c.884 affecting the setWiFiBasicConfig function in /cgi-bin/cstecgi.cgi. Manipulation of the KeyStr argument leads to a buffer overflow. The attack can be initiated remotely and a public exploit is available.
- CVE-2026-123960Critical
In TOTOLINK CA300-PoE version 6.2c.884, the setWanConfig function in /cgi-bin/cstecgi.cgi improperly handles the pppoeUser/priDns/secDns arguments, leading to a buffer overflow. The vulnerability can be exploited remotely, and a public exploit is already available.
- CVE-2026-123959Critical
In TOTOLINK CA300-PoE version 6.2c.884, the setLanguageCfg function in /cgi-bin/cstecgi.cgi improperly processes the langType argument, resulting in a buffer overflow. The attack can be initiated remotely, and the exploit has been publicly released.
- CVE-2026-123958Critical
In TOTOLINK CA300-PoE version 6.2c.884, the setLanConfig function in /cgi-bin/cstecgi.cgi mishandles the lanDns/lanSecDns/langType arguments, leading to a buffer overflow. The vulnerability can be exploited remotely, and a public exploit is already available.
Original NVD description (English source)
A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS