{"id":"CVE-2026-123960","kind":"vulnerability","aliases":["CVE-2026-123960"],"related":[],"title":"TOTOLINK CA300-PoE router: WAN setup flaw allows remote buffer overflow","description":"A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument pppoeUser/priDns/secDns can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.","summary":"The TOTOLINK CA300-PoE 6.2c.884 web interface has a buffer overflow in its setWanConfig handler at /cgi-bin/cstecgi.cgi, triggered through the pppoeUser, priDns and secDns arguments. A remote attacker can send crafted requests to overflow memory, and a public exploit has been released.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CA300-PoE firmware","fixed":[],"affected":"6.2c.884","ecosystem":"vendor"}],"ecosystems":[],"tags":["ca300-poe","infrastructure","iot","routers","totolink"],"not_affected_if":["admin-interface-not-exposed","other-firmware"],"how_to_check":"- Check the firmware version on the device admin page; the affected version is `6.2c.884`.\n- Confirm whether the web management interface is reachable from the internet or untrusted networks.\n- Look for requests to `/cgi-bin/cstecgi.cgi` with `setWanConfig` in access logs.","fix":null,"status":"open","published_at":"2026-11-07T10:17:12+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","triaged_at":"2026-11-07T10:48:20+00:00","updated_at":"2026-11-07T10:49:30+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T10:48:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TOTOLINK CA300-PoE router: WAN setup flaw allows remote buffer overflow","impact":"high","summary":"The TOTOLINK CA300-PoE 6.2c.884 web interface has a buffer overflow in its setWanConfig handler at /cgi-bin/cstecgi.cgi, triggered through the pppoeUser, priDns and secDns arguments. A remote attacker can send crafted requests to overflow memory, and a public exploit has been released.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["totolink","ca300-poe","iot","routers"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the router remotely","analyst_note":"Check the NVD entry and TOTOLINK vendor advisories for a fixed firmware version and whether authentication is required before setWanConfig is reachable.","how_to_check":"- Check the firmware version on the device admin page; the affected version is `6.2c.884`.\n- Confirm whether the web management interface is reachable from the internet or untrusted networks.\n- Look for requests to `/cgi-bin/cstecgi.cgi` with `setWanConfig` in access logs.","plain_action":"","needs_analyst":true,"not_affected_if":["other-firmware","admin-interface-not-exposed"],"who_is_affected":"Devices running TOTOLINK CA300-PoE firmware 6.2c.884 with the web management interface exposed to the network. Hosts where the router's admin interface is restricted to trusted internal addresses are less exposed, but the sources do not state the exact preconditions. Teams not running this device can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000745,"input_tokens":4249,"output_tokens":641,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and TOTOLINK vendor advisories for a fixed firmware version and whether authentication is required before setWanConfig is reachable.","search":"'-123960':15A,18A '-2026':14A,17A '/cgi-bin/cstecgi.cgi':48B,94C '6.2':35B,84C 'affect':87C 'allow':9A 'argument':56B,100C 'attack':59B,108C,127C 'avail':118C 'buffer':11A,41B,105C 'c.884':36B,85C 'ca300':3A,20A,24B,33B,82C 'ca300-poe':2A,19A,23B,32B,81C 'could':123C 'craft':62B 'cve':13A,16A 'execut':95C 'exploit':70B,114C 'file':93C 'firmware':22A 'flaw':8A 'function':89C 'handler':46B 'identifi':78C 'infrastructur':26B 'interfac':38B 'iot':27B 'launch':111C 'lead':103C 'made':117C 'manipul':97C 'memori':66B 'overflow':12A,42B,65B,106C 'poe':4A,21A,25B,34B,83C 'pppoeuser':52B 'pppoeuser/pridns/secdns':101C 'pridn':53B 'public':69B,121C 'releas':73B 'remot':10A,58B,112C 'request':63B 'router':5A,28B 'secdn':55B 'send':61B 'setup':7A 'setwanconfig':45B,90C 'totolink':1A,29B,31B,80C 'trigger':49B 'use':125C 'wan':6A 'weak':75C 'web':37B","nicknames":[],"mitigations":[],"who_affected":"TOTOLINK CA300-PoE routers running firmware 6.2c.884 whose web management interface (/cgi-bin/cstecgi.cgi) can be reached by an attacker. The CVSS vector lists low privileges required, so a login may be needed, but no vendor source confirms this. No fixed firmware has been published that we could find. Teams without this device can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["ca300poefirmware","firmware"],"ptokens":["ca300","firmware","poe"],"labels":["ca300poe","critical","infrastructure","iot","routers","totolink"],"campaign_type":null,"search_a":"'-123960':15A,18A '-2026':14A,17A 'allow':9A 'buffer':11A 'ca300':3A,20A 'ca300-poe':2A,19A 'cve':13A,16A 'firmware':22A 'flaw':8A 'overflow':12A 'poe':4A,21A 'remot':10A 'router':5A 'setup':7A 'totolink':1A 'wan':6A","search_b":"'/cgi-bin/cstecgi.cgi':48B '6.2':35B 'argument':56B 'attack':59B 'buffer':41B 'c.884':36B 'ca300':24B,33B 'ca300-poe':23B,32B 'craft':62B 'exploit':70B 'handler':46B 'infrastructur':26B 'interfac':38B 'iot':27B 'memori':66B 'overflow':42B,65B 'poe':25B,34B 'pppoeuser':52B 'pridn':53B 'public':69B 'releas':73B 'remot':58B 'request':63B 'router':28B 'secdn':55B 'send':61B 'setwanconfig':45B 'totolink':29B,31B 'trigger':49B 'web':37B","search_c":"'/cgi-bin/cstecgi.cgi':94C '6.2':84C 'affect':87C 'argument':100C 'attack':108C,127C 'avail':118C 'buffer':105C 'c.884':85C 'ca300':82C 'ca300-poe':81C 'could':123C 'execut':95C 'exploit':114C 'file':93C 'function':89C 'identifi':78C 'launch':111C 'lead':103C 'made':117C 'manipul':97C 'overflow':106C 'poe':83C 'pppoeuser/pridns/secdns':101C 'public':121C 'remot':112C 'setwanconfig':90C 'totolink':80C 'use':125C 'weak':75C","first_public_at":"2026-11-07T10:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123960","severity":null,"published_at":"2026-11-07T10:17:12+00:00","modified_at":"2026-11-07T10:17:12+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","fetched_at":"2026-11-07T10:46:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123960:2096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123960","severity":null,"published_at":"2026-11-07T10:49:30+00:00","modified_at":"2026-11-07T10:49:30+00:00","first_seen_at":"2026-11-07T10:49:30+00:00","fetched_at":"2026-11-07T10:49:30+00:00","note":"Only NVD/VulDB-sourced record found (CNA vuldb). No TOTOLINK advisory or fixed firmware located; no vendor page saying no fix, so fix left unknown. CVSS 4.0 vector has PR:L, so some login likely needed, not confirmed by vendor. Public exploit claimed by CNA, no link found. Sibling CA300-PoE CVEs 123957-59 same pattern. Nothing verified.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-123960"]}],"documents":[{"id":94902,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123960","title":"NVD CVE-2026-123960","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}