{"id":"CVE-2026-123959","kind":"vulnerability","aliases":["CVE-2026-123959"],"related":[],"title":"TOTOLINK CA300-PoE: setLanguageCfg langType argument buffer overflow allows remote attack","description":"A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument langType results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.","summary":"The TOTOLINK CA300-PoE 6.2c.884 web management CGI function setLanguageCfg in /cgi-bin/cstecgi.cgi overflows a buffer when the langType argument is manipulated. A remote attacker can trigger it over the network, and a public exploit has been released.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CA300-PoE","fixed":[],"affected":"6.2c.884","ecosystem":"vendor"}],"ecosystems":[],"tags":["ca300-poe","embedded","infrastructure","iot","totolink"],"not_affected_if":["no-network-exposure","other-firmware-version"],"how_to_check":"Look up the firmware version on the device's web admin page (System/Status); 6.2c.884 is the version named in the CVE. Check whether the admin web interface (/cgi-bin/cstecgi.cgi) is reachable from the internet or untrusted networks. No fixed version or vendor check command was found. Also check other CA300-PoE builds, since only 6.2c.884 is named.","fix":null,"status":"open","published_at":"2026-11-07T10:17:12+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","triaged_at":"2026-11-07T10:48:20+00:00","updated_at":"2026-11-07T10:49:35+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-07T10:48:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TOTOLINK CA300-PoE: setLanguageCfg langType argument buffer overflow allows remote attack","impact":"high","summary":"The TOTOLINK CA300-PoE 6.2c.884 web management CGI function setLanguageCfg in /cgi-bin/cstecgi.cgi overflows a buffer when the langType argument is manipulated. A remote attacker can trigger it over the network, and a public exploit has been released.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["totolink","ca300-poe","iot","embedded"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker may overflow memory and potentially run code on the device","analyst_note":"Confirm fixed firmware version and vendor advisory for TOTOLINK CA300-PoE; check whether authentication is needed to reach cstecgi.cgi.","how_to_check":"- Check the firmware version on the device admin page, or run `unknown` if the sources do not give a command\n- Confirm whether the web management interface is reachable from the internet (unknown if the sources do not say how)","plain_action":"","needs_analyst":true,"not_affected_if":["other-firmware-version","no-network-exposure"],"who_is_affected":"Any TOTOLINK CA300-PoE device running firmware 6.2c.884 with its web management CGI reachable over the network is exposed. Devices kept off untrusted networks and not exposing the admin interface are at lower risk. The sources do not state whether authentication is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000722,"input_tokens":4244,"output_tokens":596,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm fixed firmware version and vendor advisory for TOTOLINK CA300-PoE; check whether authentication is needed to reach cstecgi.cgi.","search":"'-123959':15A,18A '-2026':14A,17A '/cgi-bin/cstecgi.cgi':42B,91C '6.2':34B,79C 'allow':10A 'argument':7A,49B,97C 'attack':12A,54B,104C,122C 'buffer':8A,45B,101C 'c.884':35B,80C 'ca300':3A,20A,23B,32B,77C 'ca300-poe':2A,19A,22B,31B,76C 'cgi':38B 'cve':13A,16A 'discov':73C 'element':83C 'embed':25B 'exploit':64B,110C 'file':90C 'flaw':70C 'function':39B,86C 'impact':82C 'infrastructur':26B 'initi':107C 'iot':27B 'langtyp':6A,48B,98C 'manag':37B 'manipul':51B,94C 'may':118C 'network':60B 'overflow':9A,43B,102C 'perform':92C 'poe':4A,21A,24B,33B,78C 'public':63B,116C 'releas':67B,113C 'remot':11A,53B,108C 'result':99C 'secur':69C 'setlanguagecfg':5A,40B,87C 'totolink':1A,28B,30B,75C 'trigger':56B 'use':120C 'web':36B","nicknames":[],"mitigations":[],"who_affected":"TOTOLINK CA300-PoE access points running firmware 6.2c.884 are named as affected. Exposure depends on whether the web management CGI /cgi-bin/cstecgi.cgi can be reached from the network. The CVSS vector lists high privileges required (PR:H), so login may be needed, but no source we read confirms this. Devices whose admin interface is only on a trusted LAN carry lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["ca300poe"],"ptokens":["ca300","poe"],"labels":["ca300poe","critical","embedded","infrastructure","iot","totolink"],"campaign_type":null,"search_a":"'-123959':15A,18A '-2026':14A,17A 'allow':10A 'argument':7A 'attack':12A 'buffer':8A 'ca300':3A,20A 'ca300-poe':2A,19A 'cve':13A,16A 'langtyp':6A 'overflow':9A 'poe':4A,21A 'remot':11A 'setlanguagecfg':5A 'totolink':1A","search_b":"'/cgi-bin/cstecgi.cgi':42B '6.2':34B 'argument':49B 'attack':54B 'buffer':45B 'c.884':35B 'ca300':23B,32B 'ca300-poe':22B,31B 'cgi':38B 'embed':25B 'exploit':64B 'function':39B 'infrastructur':26B 'iot':27B 'langtyp':48B 'manag':37B 'manipul':51B 'network':60B 'overflow':43B 'poe':24B,33B 'public':63B 'releas':67B 'remot':53B 'setlanguagecfg':40B 'totolink':28B,30B 'trigger':56B 'web':36B","search_c":"'/cgi-bin/cstecgi.cgi':91C '6.2':79C 'argument':97C 'attack':104C,122C 'buffer':101C 'c.884':80C 'ca300':77C 'ca300-poe':76C 'discov':73C 'element':83C 'exploit':110C 'file':90C 'flaw':70C 'function':86C 'impact':82C 'initi':107C 'langtyp':98C 'manipul':94C 'may':118C 'overflow':102C 'perform':92C 'poe':78C 'public':116C 'releas':113C 'remot':108C 'result':99C 'secur':69C 'setlanguagecfg':87C 'totolink':75C 'use':120C","first_public_at":"2026-11-07T10:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123959","severity":null,"published_at":"2026-11-07T10:17:12+00:00","modified_at":"2026-11-07T10:17:12+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","fetched_at":"2026-11-07T10:46:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123959:2097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123959","severity":null,"published_at":"2026-11-07T10:49:35+00:00","modified_at":"2026-11-07T10:49:35+00:00","first_seen_at":"2026-11-07T10:49:35+00:00","fetched_at":"2026-11-07T10:49:35+00:00","note":"Only NVD/aggregator text found (CVE description, CNA vuldb, CVSS 4.0 vector PR:H suggests auth needed, not confirmed). No TOTOLINK vendor advisory or fixed firmware found; no PoC link found despite 'exploit public' claim. Nothing verified. Fix unknown; settle by checking the TOTOLINK download page for CA300-PoE and the VulDB entry. Sibling CVEs 123957/123958 same product.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-123959"]}],"documents":[{"id":94905,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123959","title":"NVD CVE-2026-123959","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}