{"id":"CVE-2026-123958","kind":"vulnerability","aliases":["CVE-2026-123958"],"related":[],"title":"TOTOLINK CA300-PoE router: setLanConfig buffer overflow allows remote attack","description":"A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument lanDns/lanSecDns/langType leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.","summary":"The TOTOLINK CA300-PoE 6.2c.884 web management interface mishandles the lanDns, lanSecDns and langType arguments of setLanConfig in /cgi-bin/cstecgi.cgi, causing a buffer overflow. A remote attacker can exploit this, and a public exploit is said to exist, which could lead to code execution on the device.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CA300-PoE","fixed":[],"affected":"6.2c.884","ecosystem":"firmware"}],"ecosystems":[],"tags":["buffer-overflow","ca300-poe","embedded","firmware","infrastructure","router","totolink"],"not_affected_if":["management-not-exposed","other-firmware-versions"],"how_to_check":"- Check whether the device is a TOTOLINK CA300-PoE running firmware 6.2c.884 (admin web interface, device info page)\n- Check whether the web management interface (/cgi-bin/cstecgi.cgi) is reachable from the internet or untrusted networks; the CVSS vector says low privileges are required, so a login may be needed\n- Also check any other TOTOLINK firmware you run: earlier CA300-PoE CVEs share the same cstecgi.cgi code, but no source confirms them here","fix":null,"status":"open","published_at":"2026-11-07T09:17:15+00:00","first_seen_at":"2026-11-07T09:46:25+00:00","triaged_at":"2026-11-07T09:47:47+00:00","updated_at":"2026-11-07T09:48:47+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T09:47:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK CA300-PoE router: setLanConfig buffer overflow allows remote attack","impact":"high","summary":"The TOTOLINK CA300-PoE 6.2c.884 web management interface mishandles the lanDns, lanSecDns and langType arguments of setLanConfig in /cgi-bin/cstecgi.cgi, causing a buffer overflow. A remote attacker can exploit this, and a public exploit is said to exist, which could lead to code execution on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["totolink","ca300-poe","router","embedded","firmware"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker may run code on the router","analyst_note":"Confirm affected firmware range and whether a vendor fix exists; check NVD entry and TOTOLINK vendor advisories for a fixed version.","how_to_check":"- Check whether the device runs firmware `6.2c.884` (shown in the admin web interface or device info page)\n- Check whether the web management interface is reachable from the internet or untrusted networks\n- unknown for any other check, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["other-firmware-versions","management-not-exposed"],"who_is_affected":"Devices running TOTOLINK CA300-PoE firmware 6.2c.884 whose web management interface (/cgi-bin/cstecgi.cgi) can be reached over the network. Devices where the management interface is not exposed beyond a trusted LAN are at lower exposure. The sources do not say which other firmware versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000742,"input_tokens":4247,"output_tokens":634,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm affected firmware range and whether a vendor fix exists; check NVD entry and TOTOLINK vendor advisories for a fixed version.","search":"'-123958':14A,17A '-2026':13A,16A '/cgi-bin/cstecgi.cgi':52B,101C '6.2':37B,89C 'affect':92C 'allow':9A 'argument':48B,106C 'attack':11A,59B,118C 'avail':124C 'buffer':7A,22B,55B,110C 'buffer-overflow':21B 'c.884':38B,90C 'ca300':3A,19A,25B,35B,87C 'ca300-poe':2A,18A,24B,34B,86C 'caus':53B 'code':75B 'could':72B 'cve':12A,15A 'devic':79B 'element':93C 'embed':27B 'execut':76B 'exist':70B 'exploit':61B,66B,121C 'file':100C 'firmwar':28B 'function':96C 'identifi':83C 'infrastructur':29B 'interfac':41B 'landn':44B 'landns/lansecdns/langtype':107C 'langtyp':47B 'lansecdn':45B 'launch':116C 'lead':73B,108C 'manag':40B 'manipul':103C 'might':126C 'mishandl':42B 'overflow':8A,23B,56B,111C 'poe':4A,20A,26B,36B,88C 'possibl':114C 'public':65B,123C 'remot':10A,58B,119C 'router':5A,30B 'said':68B 'setlanconfig':6A,50B,97C 'totolink':1A,31B,33B,85C 'use':128C 'vulner':81C 'web':39B","nicknames":[],"mitigations":[],"who_affected":"Devices running TOTOLINK CA300-PoE firmware 6.2c.884 whose web management interface (/cgi-bin/cstecgi.cgi) can be reached over the network. Devices where the management interface is not exposed beyond a trusted LAN are at lower exposure. The sources do not say which other firmware versions are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ca300poe"],"ptokens":["ca300","poe"],"labels":["bufferoverflow","ca300poe","critical","embedded","firmware","infrastructure","router","totolink"],"campaign_type":null,"search_a":"'-123958':14A,17A '-2026':13A,16A 'allow':9A 'attack':11A 'buffer':7A 'ca300':3A,19A 'ca300-poe':2A,18A 'cve':12A,15A 'overflow':8A 'poe':4A,20A 'remot':10A 'router':5A 'setlanconfig':6A 'totolink':1A","search_b":"'/cgi-bin/cstecgi.cgi':52B '6.2':37B 'argument':48B 'attack':59B 'buffer':22B,55B 'buffer-overflow':21B 'c.884':38B 'ca300':25B,35B 'ca300-poe':24B,34B 'caus':53B 'code':75B 'could':72B 'devic':79B 'embed':27B 'execut':76B 'exist':70B 'exploit':61B,66B 'firmwar':28B 'infrastructur':29B 'interfac':41B 'landn':44B 'langtyp':47B 'lansecdn':45B 'lead':73B 'manag':40B 'mishandl':42B 'overflow':23B,56B 'poe':26B,36B 'public':65B 'remot':58B 'router':30B 'said':68B 'setlanconfig':50B 'totolink':31B,33B 'web':39B","search_c":"'/cgi-bin/cstecgi.cgi':101C '6.2':89C 'affect':92C 'argument':106C 'attack':118C 'avail':124C 'buffer':110C 'c.884':90C 'ca300':87C 'ca300-poe':86C 'element':93C 'exploit':121C 'file':100C 'function':96C 'identifi':83C 'landns/lansecdns/langtype':107C 'launch':116C 'lead':108C 'manipul':103C 'might':126C 'overflow':111C 'poe':88C 'possibl':114C 'public':123C 'remot':119C 'setlanconfig':97C 'totolink':85C 'use':128C 'vulner':81C","first_public_at":"2026-11-07T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123958","severity":null,"published_at":"2026-11-07T09:17:15+00:00","modified_at":"2026-11-07T09:17:15+00:00","first_seen_at":"2026-11-07T09:46:25+00:00","fetched_at":"2026-11-07T09:46:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123958:2092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123958","severity":null,"published_at":"2026-11-07T09:48:47+00:00","modified_at":"2026-11-07T09:48:47+00:00","first_seen_at":"2026-11-07T09:48:47+00:00","fetched_at":"2026-11-07T09:48:47+00:00","note":"NVD record and mirrors only; no TOTOLINK advisory or fixed firmware found (vendor download page lists no fix). Affected: 6.2c.884 only per NVD. Public exploit said to exist but no link found, no exploitation confirmed. Nothing verified. Sibling CVE-2026-123957 same product.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-123958","https://securityonline.info/cve-watchtower/cve-2026-123958/"]}],"documents":[{"id":94597,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123958","title":"NVD: CVE-2026-123958","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":94598,"url":"https://securityonline.info/cve-watchtower/cve-2026-123958/","title":"CVE Watchtower: CVE-2026-123958","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}