{"id":"CVE-2026-124057","kind":"vulnerability","aliases":["CVE-2026-124057"],"related":[],"title":"TOTOLINK CA300-PoE: remote buffer overflow in Wi-Fi config handler","description":"A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument Key1Str1 results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.","summary":"TOTOLINK CA300-PoE firmware 6.2c.884 has a buffer overflow in the setWiFiMultipleConfig function of its web CGI endpoint, triggered by the Key1Str1 argument. A remote attacker can send a crafted request to overflow memory, and a public exploit has been released.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CA300-PoE","fixed":[],"affected":"6.2c.884","ecosystem":"firmware"}],"ecosystems":[],"tags":["auth-required","ca300-poe","embedded","firmware","infrastructure","router","totolink"],"not_affected_if":["management-interface-not-reachable","no-network-exposure","other-firmware-version"],"how_to_check":"- Check the firmware version on the device admin page; 6.2c.884 is the only version reported affected (other versions unconfirmed, not necessarily safe).\n- Check whether the web management interface (/cgi-bin/cstecgi.cgi) is reachable from the internet or untrusted networks.\n- VulDB says exploitation needs an authenticated session; also check for weak or default admin passwords.\n- Look for requests to /cgi-bin/cstecgi.cgi with setWiFiMultipleConfig and an oversized Key1Str1 in logs, if the device forwards them.","fix":null,"status":"open","published_at":"2026-11-07T18:17:21+00:00","first_seen_at":"2026-11-07T18:48:29+00:00","triaged_at":"2026-11-07T18:50:00+00:00","updated_at":"2026-11-07T18:50:44+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T18:50:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TOTOLINK CA300-PoE: remote buffer overflow in Wi-Fi config handler","impact":"high","summary":"TOTOLINK CA300-PoE firmware 6.2c.884 has a buffer overflow in the setWiFiMultipleConfig function of its web CGI endpoint, triggered by the Key1Str1 argument. A remote attacker can send a crafted request to overflow memory, and a public exploit has been released.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["totolink","ca300-poe","embedded","router","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker may overflow memory and potentially run code on the device","analyst_note":"Check the vendor advisory or NVD for a fixed firmware version and whether authentication is required for the cstecgi.cgi endpoint.","how_to_check":"- Check the firmware version on the device admin page; `6.2c.884` is the affected version.\n- Check whether the device's web management interface is reachable from the internet or untrusted networks.\n- Look for requests to `/cgi-bin/cstecgi.cgi` in access logs, if the device forwards them.","plain_action":"","needs_analyst":true,"not_affected_if":["other-firmware-version","no-network-exposure"],"who_is_affected":"Anyone running TOTOLINK CA300-PoE firmware 6.2c.884 whose management interface can be reached over the network. Devices kept off the internet and isolated from untrusted networks have much less exposure. The sources do not name a fixed firmware version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000734,"input_tokens":4251,"output_tokens":618,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the vendor advisory or NVD for a fixed firmware version and whether authentication is required for the cstecgi.cgi endpoint.","search":"'-124057':16A,19A '-2026':15A,18A '/cgi-bin/cstecgi.cgi':98C '6.2':39B,88C 'argument':58B,104C 'attack':61B,111C,129C 'auth':24B 'auth-requir':23B 'buffer':6A,43B,108C 'c.884':40B,89C 'ca300':3A,21A,27B,36B,86C 'ca300-poe':2A,20A,26B,35B,85C 'cgi':52B 'config':12A 'craft':65B 'cve':14A,17A 'discov':82C 'embed':29B 'endpoint':53B 'exploit':73B,117C 'fi':11A 'file':97C 'firmwar':30B,38B 'flaw':79C 'function':48B,93C 'handler':13A 'impact':91C 'infrastructur':31B 'initi':114C 'key1str1':57B,105C 'manipul':101C 'may':125C 'memori':69B 'overflow':7A,44B,68B,109C 'perform':99C 'poe':4A,22A,28B,37B,87C 'public':72B,123C 'releas':76B,120C 'remot':5A,60B,115C 'request':66B 'requir':25B 'result':106C 'router':32B 'secur':78C 'send':63B 'setwifimultipleconfig':47B,94C 'totolink':1A,33B,34B,84C 'trigger':54B 'use':127C 'web':51B 'wi':10A 'wi-fi':9A","nicknames":[],"mitigations":[],"who_affected":"Anyone running a TOTOLINK CA300-PoE access point on firmware 6.2c.884 whose web management interface can be reached by an attacker. VulDB says additional authentication is needed, so exposure is highest where admin credentials are default or weak. Devices with management restricted to a trusted network have much less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["ca300poe"],"ptokens":["ca300","poe"],"labels":["authrequired","ca300poe","critical","embedded","firmware","infrastructure","router","totolink"],"campaign_type":null,"search_a":"'-124057':16A,19A '-2026':15A,18A 'buffer':6A 'ca300':3A,21A 'ca300-poe':2A,20A 'config':12A 'cve':14A,17A 'fi':11A 'handler':13A 'overflow':7A 'poe':4A,22A 'remot':5A 'totolink':1A 'wi':10A 'wi-fi':9A","search_b":"'6.2':39B 'argument':58B 'attack':61B 'auth':24B 'auth-requir':23B 'buffer':43B 'c.884':40B 'ca300':27B,36B 'ca300-poe':26B,35B 'cgi':52B 'craft':65B 'embed':29B 'endpoint':53B 'exploit':73B 'firmwar':30B,38B 'function':48B 'infrastructur':31B 'key1str1':57B 'memori':69B 'overflow':44B,68B 'poe':28B,37B 'public':72B 'releas':76B 'remot':60B 'request':66B 'requir':25B 'router':32B 'send':63B 'setwifimultipleconfig':47B 'totolink':33B,34B 'trigger':54B 'web':51B","search_c":"'/cgi-bin/cstecgi.cgi':98C '6.2':88C 'argument':104C 'attack':111C,129C 'buffer':108C 'c.884':89C 'ca300':86C 'ca300-poe':85C 'discov':82C 'exploit':117C 'file':97C 'flaw':79C 'function':93C 'impact':91C 'initi':114C 'key1str1':105C 'manipul':101C 'may':125C 'overflow':109C 'perform':99C 'poe':87C 'public':123C 'releas':120C 'remot':115C 'result':106C 'secur':78C 'setwifimultipleconfig':94C 'totolink':84C 'use':127C","first_public_at":"2026-11-07T18:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124057","severity":null,"published_at":"2026-11-07T18:17:21+00:00","modified_at":"2026-11-07T18:17:21+00:00","first_seen_at":"2026-11-07T18:48:29+00:00","fetched_at":"2026-11-07T18:48:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124057:2139","url":"https://vuldb.com/vuln/432112","severity":null,"published_at":"2026-11-07T18:50:44+00:00","modified_at":"2026-11-07T18:50:44+00:00","first_seen_at":"2026-11-07T18:50:44+00:00","fetched_at":"2026-11-07T18:50:44+00:00","note":"No TOTOLINK advisory found; read VulDB VDB-432112 (CNA). Affects CA300-PoE 6.2c.884; PoC claimed on a Notion page (link not readable); VulDB says exploitation needs additional authentication (CVSS4 PR:H) and no countermeasures known; no fix stated by vendor. Nothing marked verified (no primary vendor source). No exploitation in the wild reported. Siblings CVE-2026-123957..61 hit the same device/endpoint.","cites":["https://vuldb.com/vuln/432112","https://nvd.nist.gov/vuln/detail/CVE-2026-124057"]}],"documents":[{"id":97436,"url":"https://vuldb.com/vuln/432112","title":"VDB-432112: TOTOLINK CA300-PoE setWiFiMultipleConfig Key1Str1 buffer overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":97437,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124057","title":"NVD CVE-2026-124057","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}