CA300-POE · CVE-2026-124059 · Infrastructure
NO FIX YET
TOTOLINK CA300-PoE 6.2c.884: setWiFiWdsAddConfig in /cgi-bin/cstecgi.cgi copies the ApCliKeyStr parameter with sprintf without a bound, causing a buffer overflow. A public PoC exists and requires a logged-in session. No vendor fix is known.
first public Nov 7, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Owners of TOTOLINK CA300-PoE access points running firmware 6.2c.884. Exploitation needs an authenticated session on the web management interface (the public PoC logs in first), so exposure is greatest where management is reachable from the internet or untrusted segments, or where admin credentials are default or weak. Devices on other firmware (not reported) or with management restricted to trusted hosts are less exposed.
Not affected if auth-required, different-firmware, management-not-exposed
Who cares auth-required, ca300-poe, embedded-device, totolink, wifi-access-point
No fix yet, per the sources.
A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this vulnerability is the function setWiFiWdsAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ApCliKeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.