CA300-POE FIRMWARE · CVE-2026-123960 · Infrastructure
NO FIX YET
The TOTOLINK CA300-PoE 6.2c.884 web interface has a buffer overflow in its setWanConfig handler at /cgi-bin/cstecgi.cgi, triggered through the pppoeUser, priDns and secDns arguments. A remote attacker can send crafted requests to overflow memory, and a public exploit has been released.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
TOTOLINK CA300-PoE routers running firmware 6.2c.884 whose web management interface (/cgi-bin/cstecgi.cgi) can be reached by an attacker. The CVSS vector lists low privileges required, so a login may be needed, but no vendor source confirms this. No fixed firmware has been published that we could find. Teams without this device can skip it.
Not affected if admin-interface-not-exposed, other-firmware
Who cares ca300-poe, iot, routers, totolink
6.2c.884./cgi-bin/cstecgi.cgi with setWanConfig in access logs.Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument pppoeUser/priDns/secDns can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.