{"id":"CVE-2026-123961","kind":"vulnerability","aliases":["CVE-2026-123961"],"related":[],"title":"TOTOLINK CA300-PoE: Wi-Fi setup flaw lets remote attackers overflow memory","description":"A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument KeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.","summary":"The TOTOLINK CA300-PoE firmware version 6.2c.884 has a buffer overflow in the setWiFiBasicConfig function of /cgi-bin/cstecgi.cgi, triggered by the KeyStr argument. The sources say an attacker may trigger it remotely, and a public exploit has been disclosed.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CA300-PoE","fixed":[],"affected":"6.2c.884","ecosystem":"totolink"}],"ecosystems":[],"tags":["ca300-poe","firmware","infrastructure","totolink","wifi-access-point"],"not_affected_if":[],"how_to_check":"- Check the firmware version in the device's web admin page; 6.2c.884 is the only version named as affected. Other versions are not tested or ruled out in the sources.\n- Check whether the web management interface (/cgi-bin/cstecgi.cgi) is reachable from the internet or from untrusted networks, and restrict it to a management network.\n- No fixed firmware is listed in the sources. Check the CA300-PoE download page at totolink.net for newer firmware.","fix":null,"status":"open","published_at":"2026-11-07T11:17:01+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","triaged_at":"2026-11-07T11:48:27+00:00","updated_at":"2026-11-07T11:49:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T11:48:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"TOTOLINK CA300-PoE: Wi-Fi setup flaw lets remote attackers overflow memory","impact":"high","summary":"The TOTOLINK CA300-PoE firmware version 6.2c.884 has a buffer overflow in the setWiFiBasicConfig function of /cgi-bin/cstecgi.cgi, triggered by the KeyStr argument. The sources say an attacker may trigger it remotely, and a public exploit has been disclosed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["totolink","ca300-poe","wifi-access-point","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker overflows device memory via Wi-Fi config request","analyst_note":"Find the vendor's fixed firmware version and any authentication requirement for CA300-PoE; start from https://nvd.nist.gov/vuln/detail/CVE-2026-123961.","how_to_check":"- Check the installed firmware version on the device; `6.2c.884` is the affected version named in the sources.\n- Check whether the device's web management interface is reachable from networks you do not control.","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources name only TOTOLINK CA300-PoE firmware 6.2c.884 and the setWiFiBasicConfig handler in cstecgi.cgi. Any device running that firmware with its web management interface reachable is in scope, and devices on other firmware are not named. The sources do not say whether authentication or a non-default setting is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00123,"input_tokens":4247,"output_tokens":1611,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor's fixed firmware version and any authentication requirement for CA300-PoE; start from https://nvd.nist.gov/vuln/detail/CVE-2026-123961.","search":"'-123961':17A,20A '-2026':16A,19A '/cgi-bin/cstecgi.cgi':52B,95C '6.2':41B,85C 'access':32B 'argument':57B,100C 'attack':12A,62B,107C 'buffer':45B,104C 'c.884':42B,86C 'ca300':3A,22A,25B,37B,83C 'ca300-poe':2A,21A,24B,36B,82C 'cve':15A,18A 'detect':79C 'disclos':73B,116C 'exploit':70B,113C 'fi':7A 'file':94C 'firmwar':27B,39B 'flaw':9A 'function':50B,90C 'impact':88C 'infrastructur':28B 'initi':110C 'keystr':56B,101C 'lead':102C 'let':10A 'manipul':97C 'may':63B,108C,119C 'memori':14A 'overflow':13A,46B,105C 'poe':4A,23A,26B,38B,84C 'point':33B 'public':69B,117C 'remot':11A,66B,111C 'say':60B 'secur':75C 'setup':8A 'setwifibasicconfig':49B,91C 'sourc':59B 'totolink':1A,29B,35B,81C 'trigger':53B,64B 'use':121C 'version':40B 'vulner':76C 'wi':6A 'wi-fi':5A 'wifi':31B 'wifi-access-point':30B","nicknames":[],"mitigations":[],"who_affected":"TOTOLINK CA300-PoE access points running firmware 6.2c.884 are affected through the setWiFiBasicConfig handler in cstecgi.cgi (KeyStr argument). The CVE record's CVSS vector uses PR:L, which suggests a low-privilege login is needed, but no source states the authentication requirement in words. Devices whose management interface is not reachable from untrusted networks are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["ca300poe"],"ptokens":["ca300","poe"],"labels":["ca300poe","critical","firmware","infrastructure","totolink","wifiaccesspoint"],"campaign_type":null,"search_a":"'-123961':17A,20A '-2026':16A,19A 'attack':12A 'ca300':3A,22A 'ca300-poe':2A,21A 'cve':15A,18A 'fi':7A 'flaw':9A 'let':10A 'memori':14A 'overflow':13A 'poe':4A,23A 'remot':11A 'setup':8A 'totolink':1A 'wi':6A 'wi-fi':5A","search_b":"'/cgi-bin/cstecgi.cgi':52B '6.2':41B 'access':32B 'argument':57B 'attack':62B 'buffer':45B 'c.884':42B 'ca300':25B,37B 'ca300-poe':24B,36B 'disclos':73B 'exploit':70B 'firmwar':27B,39B 'function':50B 'infrastructur':28B 'keystr':56B 'may':63B 'overflow':46B 'poe':26B,38B 'point':33B 'public':69B 'remot':66B 'say':60B 'setwifibasicconfig':49B 'sourc':59B 'totolink':29B,35B 'trigger':53B,64B 'version':40B 'wifi':31B 'wifi-access-point':30B","search_c":"'/cgi-bin/cstecgi.cgi':95C '6.2':85C 'argument':100C 'attack':107C 'buffer':104C 'c.884':86C 'ca300':83C 'ca300-poe':82C 'detect':79C 'disclos':116C 'exploit':113C 'file':94C 'function':90C 'impact':88C 'initi':110C 'keystr':101C 'lead':102C 'manipul':97C 'may':108C,119C 'overflow':105C 'poe':84C 'public':117C 'remot':111C 'secur':75C 'setwifibasicconfig':91C 'totolink':81C 'use':121C 'vulner':76C","first_public_at":"2026-11-07T11:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123961","severity":null,"published_at":"2026-11-07T11:17:01+00:00","modified_at":"2026-11-07T11:17:01+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","fetched_at":"2026-11-07T11:46:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123961:2105","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123961","severity":null,"published_at":"2026-11-07T11:49:34+00:00","modified_at":"2026-11-07T11:49:34+00:00","first_seen_at":"2026-11-07T11:49:34+00:00","fetched_at":"2026-11-07T11:49:34+00:00","note":"Only NVD/CVE record text found (via VulDB CNA); no TOTOLINK advisory, no fixed firmware, no PoC link located. Auth requirement unclear (CVSS PR:L). Fix status left unknown, nothing verified. X not checked.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-123961","https://www.rapid7.com/db/vulnerabilities/cve-2026-123961/"]}],"documents":[{"id":95222,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123961","title":"NVD CVE-2026-123961","kind":"advisory","source":"analyst","publisher":null,"text":"A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument KeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. CNA cna@vuldb.com CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":95223,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-123961/","title":"Rapid7 CVE-2026-123961","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}