---
id: "CVE-2026-124058"
page: "https://infrastack.ai/live/CVE-2026-124058"
kind: "vulnerability"
aliases: ["CVE-2026-124058"]
title: "TOTOLINK CA300-PoE: remote buffer overflow in Wi-Fi repeater setup"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "CA300-PoE", "fixed": [], "affected": "6.2c.884", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "ca300-poe", "embedded", "infrastructure", "iot", "router", "totolink"]
not_affected_if: ["management-interface-not-exposed", "other-firmware"]
published_at: "2026-11-07T19:17:28+00:00"
first_seen_at: "2026-11-07T19:18:31+00:00"
updated_at: "2026-11-07T19:20:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124058", "first_seen_at": "2026-11-07T19:18:31+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/432113", "first_seen_at": "2026-11-07T19:20:06+00:00", "cites": ["https://vuldb.com/vuln/432113"]}]
exploit_sources: []
---

# TOTOLINK CA300-PoE: remote buffer overflow in Wi-Fi repeater setup

Link for people: https://infrastack.ai/live/CVE-2026-124058 (this .md is for agents)

A buffer overflow in setWiFiRepeaterConfig (argument ApCliKeyStr, /cgi-bin/cstecgi.cgi) of TOTOLINK CA300-PoE 6.2c.884. VulDB says it can be attacked remotely but needs an authenticated session. A public proof of concept exists. The sources do not say what an attacker can run after the overflow, and no fixed firmware is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CA300-PoE affected 6.2c.884 fixed no fixed version listed

## How to check

- Check the firmware version in the device admin page; 6.2c.884 is the only version named as affected.
- Check whether the web management interface (serving /cgi-bin/cstecgi.cgi) is reachable from the internet or from untrusted networks; if so, restrict it to a management VLAN or VPN.
- Also check other CA300-PoE firmware builds: sources name only 6.2c.884, so others are unconfirmed.
- Several other cstecgi.cgi overflows were reported on the same device the same day, so restricting management access helps against all of them.

## Timeline

- 2026-11-07T19:18:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124058
- 2026-11-07T19:20:06+00:00 analyst https://vuldb.com/vuln/432113 — VulDB (CNA) entry VDB-432113 read: exploitation needs additional authentication (CVSS PR:H); PoC is a Notion page (lavender-bicycle-a5a.notion.site, not fetched, not saved). No TOTOLINK advisory or fixed firmware found, so fix stays unknown (no vendor page saying none, so no fix-status claim). Nothing verified: no vendor primary source. Sibling CVEs on the same device: 123957-123961, 124057. X not checked.

## Documents

- [advisory] VulDB VDB-432113: TOTOLINK CA300-PoE setWiFiRepeaterConfig ApCliKeyStr buffer overflow https://vuldb.com/vuln/432113

## From the sources

A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_