{"id":"CVE-2026-124058","kind":"vulnerability","aliases":["CVE-2026-124058"],"related":[],"title":"TOTOLINK CA300-PoE: remote buffer overflow in Wi-Fi repeater setup","description":"A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.","summary":"A buffer overflow in setWiFiRepeaterConfig (argument ApCliKeyStr, /cgi-bin/cstecgi.cgi) of TOTOLINK CA300-PoE 6.2c.884. VulDB says it can be attacked remotely but needs an authenticated session. A public proof of concept exists. The sources do not say what an attacker can run after the overflow, and no fixed firmware is known.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CA300-PoE","fixed":[],"affected":"6.2c.884","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","ca300-poe","embedded","infrastructure","iot","router","totolink"],"not_affected_if":["management-interface-not-exposed","other-firmware"],"how_to_check":"- Check the firmware version in the device admin page; 6.2c.884 is the only version named as affected.\n- Check whether the web management interface (serving /cgi-bin/cstecgi.cgi) is reachable from the internet or from untrusted networks; if so, restrict it to a management VLAN or VPN.\n- Also check other CA300-PoE firmware builds: sources name only 6.2c.884, so others are unconfirmed.\n- Several other cstecgi.cgi overflows were reported on the same device the same day, so restricting management access helps against all of them.","fix":null,"status":"open","published_at":"2026-11-07T19:17:28+00:00","first_seen_at":"2026-11-07T19:18:31+00:00","triaged_at":"2026-11-07T19:19:08+00:00","updated_at":"2026-11-07T19:20:06+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T19:19:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TOTOLINK CA300-PoE: remote buffer overflow in Wi-Fi repeater setup","impact":"high","summary":"A buffer overflow in the setWiFiRepeaterConfig function of TOTOLINK CA300-PoE 6.2c.884 is triggered by a manipulated ApCliKeyStr argument sent to /cgi-bin/cstecgi.cgi. A public exploit exists, and the sources do not state what an attacker can run after the overflow.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["totolink","ca300-poe","embedded","iot","router"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker may crash the device or run code on it","analyst_note":"Confirm whether the CA300-PoE setWiFiRepeaterConfig flaw needs authentication, check the vendor advisory for a fixed firmware version, and find the public exploit reference cited in the NVD entry.","how_to_check":"- Check the firmware version on the device admin page; the affected build is `6.2c.884`\n- Check whether the web management interface is reachable from the internet, for example by testing the device's public address on port 80 or 443\n- unknown for any other check, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["other-firmware","management-interface-not-exposed"],"who_is_affected":"Any TOTOLINK CA300-PoE device running firmware 6.2c.884 whose web management interface can be reached over the network is in scope. The sources do not say whether the flaw needs a login, so treat the device as exposed until the vendor confirms otherwise. Devices kept off the internet and behind a firewall that blocks the management interface are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00076,"input_tokens":4252,"output_tokens":670,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the CA300-PoE setWiFiRepeaterConfig flaw needs authentication, check the vendor advisory for a fixed firmware version, and find the public exploit reference cited in the NVD entry.","search":"'-124058':16A,19A '-2026':15A,18A '/cgi-bin/cstecgi.cgi':41B,106C '6.2':47B,96C 'affect':98C 'apclikeystr':40B,113C 'argument':39B,112C 'attack':54B,74B,120C,139C 'auth':24B 'auth-requir':23B 'authent':59B 'avail':130C 'buffer':6A,35B,117C 'c.884':48B,97C 'ca300':3A,21A,27B,45B,94C 'ca300-poe':2A,20A,26B,44B,93C 'concept':65B 'could':135C 'cve':14A,17A 'embed':29B 'execut':107C 'exist':66B 'exploit':126C 'fi':11A 'file':105C 'firmwar':83B 'fix':82B 'function':101C 'identifi':90C 'infrastructur':30B 'iot':31B 'known':85B 'launch':123C 'lead':115C 'made':129C 'manipul':109C 'need':57B 'overflow':7A,36B,79B,118C 'poe':4A,22A,28B,46B,95C 'proof':63B 'public':62B,133C 'remot':5A,55B,124C 'repeat':12A 'requir':25B 'router':32B 'run':76B 'say':50B,71B 'session':60B 'setup':13A 'setwifirepeaterconfig':38B,102C 'sourc':68B 'totolink':1A,33B,43B,92C 'use':137C 'vuldb':49B 'weak':87C 'wi':10A 'wi-fi':9A","nicknames":[],"mitigations":[],"who_affected":"TOTOLINK CA300-PoE devices running firmware 6.2c.884 are affected. VulDB says exploitation needs an authenticated session on the web management interface, so this is not a pre-login flaw, but a public proof of concept exists. Risk is highest where the admin interface is reachable from the internet or shared networks, or the admin password is default or weak. Devices with management access limited to a trusted network can treat this as lower priority. No fixed firmware has been found.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["ca300poe"],"ptokens":["ca300","poe"],"labels":["authrequired","ca300poe","critical","embedded","infrastructure","iot","router","totolink"],"campaign_type":null,"search_a":"'-124058':16A,19A '-2026':15A,18A 'buffer':6A 'ca300':3A,21A 'ca300-poe':2A,20A 'cve':14A,17A 'fi':11A 'overflow':7A 'poe':4A,22A 'remot':5A 'repeat':12A 'setup':13A 'totolink':1A 'wi':10A 'wi-fi':9A","search_b":"'/cgi-bin/cstecgi.cgi':41B '6.2':47B 'apclikeystr':40B 'argument':39B 'attack':54B,74B 'auth':24B 'auth-requir':23B 'authent':59B 'buffer':35B 'c.884':48B 'ca300':27B,45B 'ca300-poe':26B,44B 'concept':65B 'embed':29B 'exist':66B 'firmwar':83B 'fix':82B 'infrastructur':30B 'iot':31B 'known':85B 'need':57B 'overflow':36B,79B 'poe':28B,46B 'proof':63B 'public':62B 'remot':55B 'requir':25B 'router':32B 'run':76B 'say':50B,71B 'session':60B 'setwifirepeaterconfig':38B 'sourc':68B 'totolink':33B,43B 'vuldb':49B","search_c":"'/cgi-bin/cstecgi.cgi':106C '6.2':96C 'affect':98C 'apclikeystr':113C 'argument':112C 'attack':120C,139C 'avail':130C 'buffer':117C 'c.884':97C 'ca300':94C 'ca300-poe':93C 'could':135C 'execut':107C 'exploit':126C 'file':105C 'function':101C 'identifi':90C 'launch':123C 'lead':115C 'made':129C 'manipul':109C 'overflow':118C 'poe':95C 'public':133C 'remot':124C 'setwifirepeaterconfig':102C 'totolink':92C 'use':137C 'weak':87C","first_public_at":"2026-11-07T19:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124058","severity":null,"published_at":"2026-11-07T19:17:28+00:00","modified_at":"2026-11-07T19:17:28+00:00","first_seen_at":"2026-11-07T19:18:31+00:00","fetched_at":"2026-11-07T19:18:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124058:2142","url":"https://vuldb.com/vuln/432113","severity":null,"published_at":"2026-11-07T19:20:06+00:00","modified_at":"2026-11-07T19:20:06+00:00","first_seen_at":"2026-11-07T19:20:06+00:00","fetched_at":"2026-11-07T19:20:06+00:00","note":"VulDB (CNA) entry VDB-432113 read: exploitation needs additional authentication (CVSS PR:H); PoC is a Notion page (lavender-bicycle-a5a.notion.site, not fetched, not saved). No TOTOLINK advisory or fixed firmware found, so fix stays unknown (no vendor page saying none, so no fix-status claim). Nothing verified: no vendor primary source. Sibling CVEs on the same device: 123957-123961, 124057. X not checked.","cites":["https://vuldb.com/vuln/432113"]}],"documents":[{"id":97558,"url":"https://vuldb.com/vuln/432113","title":"VulDB VDB-432113: TOTOLINK CA300-PoE setWiFiRepeaterConfig ApCliKeyStr buffer overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}