{"id":"CVE-2026-123957","kind":"vulnerability","aliases":["CVE-2026-123957"],"related":[],"title":"TOTOLINK CA300-PoE: remote buffer overflow in setIpQosRules lets attackers run code","description":"A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.","summary":"TOTOLINK CA300-PoE firmware 6.2c.884 has a buffer overflow in the setIpQosRules function of /cgi-bin/cstecgi.cgi, triggered by an oversized ipStart argument. The exploit has been publicly disclosed, so an attacker reaching the device over the network could crash it or likely run code on it.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CA300-PoE","fixed":[],"affected":"6.2c.884","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","ca300-poe","embedded","firmware","infrastructure","router","totolink"],"not_affected_if":["management-not-exposed","other-firmware-version"],"how_to_check":"- Log in to the CA300-PoE admin page and read the firmware version; 6.2c.884 is the version named in NVD.\n- Check whether the web management interface (/cgi-bin/cstecgi.cgi) is reachable from the internet or untrusted networks.\n- Other firmware versions are not stated as affected or unaffected; the sources do not say.","fix":null,"status":"open","published_at":"2026-11-07T09:17:14+00:00","first_seen_at":"2026-11-07T09:46:25+00:00","triaged_at":"2026-11-07T09:47:47+00:00","updated_at":"2026-11-07T09:48:42+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-11-07T09:47:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TOTOLINK CA300-PoE: remote buffer overflow in setIpQosRules lets attackers run code","impact":"high","summary":"TOTOLINK CA300-PoE firmware 6.2c.884 has a buffer overflow in the setIpQosRules function of /cgi-bin/cstecgi.cgi, triggered by an oversized ipStart argument. The exploit has been publicly disclosed, so an attacker reaching the device over the network could crash it or likely run code on it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["totolink","ca300-poe","router","embedded","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker runs code on the device","analyst_note":"Check the NVD entry and any vendor advisory for a fixed firmware version and whether authentication is needed to reach setIpQosRules.","how_to_check":"- Check the firmware version on the device admin page; `6.2c.884` is the affected version named in the sources.\n- Check whether the web management interface is reachable from the internet or untrusted networks.\n- unknown for any further detection method.","plain_action":"","needs_analyst":true,"not_affected_if":["other-firmware-version","management-not-exposed"],"who_is_affected":"Any TOTOLINK CA300-PoE device running firmware 6.2c.884 whose web management interface (cstecgi.cgi) is reachable by an attacker. The sources do not say whether authentication is required to reach the vulnerable function or whether other firmware versions are affected. Devices not running this firmware, or with the management interface kept off untrusted networks, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000743,"input_tokens":4243,"output_tokens":637,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and any vendor advisory for a fixed firmware version and whether authentication is needed to reach setIpQosRules.","search":"'-123957':16A,19A '-2026':15A,18A '/cgi-bin/cstecgi.cgi':50B,98C '6.2':39B,88C 'argument':56B,103C 'attack':11A,65B,114C 'auth':24B 'auth-requir':23B 'buffer':6A,43B,106C 'c.884':40B,89C 'ca300':3A,21A,27B,36B,86C 'ca300-poe':2A,20A,26B,35B,85C 'caus':105C 'code':13A,78B 'could':72B 'crash':73B 'cve':14A,17A 'determin':82C 'devic':68B 'disclos':62B,121C 'embed':29B 'exploit':58B,117C 'file':97C 'firmwar':30B,38B 'function':48B,93C 'impact':90C 'infrastructur':31B 'initi':112C 'ipstart':55B,104C 'let':10A 'like':76B 'manipul':100C 'may':123C 'network':71B 'overflow':7A,44B,107C 'overs':54B 'poe':4A,22A,28B,37B,87C 'possibl':110C 'public':61B,120C 'reach':66B 'remot':5A,115C 'requir':25B 'router':32B 'run':12A,77B 'setipqosrul':9A,47B,94C 'totolink':1A,33B,34B,84C 'trigger':51B 'util':125C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"TOTOLINK CA300-PoE devices running firmware 6.2c.884 whose web management interface is reachable by an attacker. The CVSS vector lists low privileges required, so a login is probably needed, but the sources do not say so outright. Devices with management kept off untrusted networks are much less exposed; other models and firmware versions are not named.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["ca300poe"],"ptokens":["ca300","poe"],"labels":["authrequired","ca300poe","critical","embedded","firmware","infrastructure","router","totolink"],"campaign_type":null,"search_a":"'-123957':16A,19A '-2026':15A,18A 'attack':11A 'buffer':6A 'ca300':3A,21A 'ca300-poe':2A,20A 'code':13A 'cve':14A,17A 'let':10A 'overflow':7A 'poe':4A,22A 'remot':5A 'run':12A 'setipqosrul':9A 'totolink':1A","search_b":"'/cgi-bin/cstecgi.cgi':50B '6.2':39B 'argument':56B 'attack':65B 'auth':24B 'auth-requir':23B 'buffer':43B 'c.884':40B 'ca300':27B,36B 'ca300-poe':26B,35B 'code':78B 'could':72B 'crash':73B 'devic':68B 'disclos':62B 'embed':29B 'exploit':58B 'firmwar':30B,38B 'function':48B 'infrastructur':31B 'ipstart':55B 'like':76B 'network':71B 'overflow':44B 'overs':54B 'poe':28B,37B 'public':61B 'reach':66B 'requir':25B 'router':32B 'run':77B 'setipqosrul':47B 'totolink':33B,34B 'trigger':51B","search_c":"'/cgi-bin/cstecgi.cgi':98C '6.2':88C 'argument':103C 'attack':114C 'buffer':106C 'c.884':89C 'ca300':86C 'ca300-poe':85C 'caus':105C 'determin':82C 'disclos':121C 'exploit':117C 'file':97C 'function':93C 'impact':90C 'initi':112C 'ipstart':104C 'manipul':100C 'may':123C 'overflow':107C 'poe':87C 'possibl':110C 'public':120C 'remot':115C 'setipqosrul':94C 'totolink':84C 'util':125C 'vulner':80C","first_public_at":"2026-11-07T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123957","severity":null,"published_at":"2026-11-07T09:17:14+00:00","modified_at":"2026-11-07T09:17:15+00:00","first_seen_at":"2026-11-07T09:46:25+00:00","fetched_at":"2026-11-07T09:46:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123957:2093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123957","severity":null,"published_at":"2026-11-07T09:48:42+00:00","modified_at":"2026-11-07T09:48:42+00:00","first_seen_at":"2026-11-07T09:48:42+00:00","fetched_at":"2026-11-07T09:48:42+00:00","note":"Only NVD/CNA (VulDB) record found; no TOTOLINK advisory or fixed firmware located, no PoC link for this CVE (sibling setIpQosRules PoCs are other models). CVSS vector has PR:L, so a login is likely needed, unconfirmed. Nothing verified.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-123957"]}],"documents":[{"id":94596,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123957","title":"NVD: CVE-2026-123957","kind":"other","source":"analyst","publisher":null,"text":"A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. Manipulation of the argument ipStart causes buffer overflow. Attack can be initiated remotely. Exploit publicly disclosed. CNA vuldb: CVSS 4.0 AV:N/AC:L/PR:L/UI:N.","published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}