CA300-POE · CVE-2026-124057 · Infrastructure
NO FIX YET
TOTOLINK CA300-PoE firmware 6.2c.884 has a buffer overflow in the setWiFiMultipleConfig function of its web CGI endpoint, triggered by the Key1Str1 argument. A remote attacker can send a crafted request to overflow memory, and a public exploit has been released.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone running a TOTOLINK CA300-PoE access point on firmware 6.2c.884 whose web management interface can be reached by an attacker. VulDB says additional authentication is needed, so exposure is highest where admin credentials are default or weak. Devices with management restricted to a trusted network have much less exposure.
Not affected if management-interface-not-reachable, no-network-exposure, other-firmware-version
Who cares auth-required, ca300-poe, embedded, firmware, router, totolink
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument Key1Str1 results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.