{"id":"CVE-2026-124059","kind":"vulnerability","aliases":["CVE-2026-124059"],"related":[],"title":"TOTOLINK CA300-PoE 6.2c.884: buffer overflow in Wi-Fi WDS setup for logged-in users, public PoC","description":"A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this vulnerability is the function setWiFiWdsAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ApCliKeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.","summary":"TOTOLINK CA300-PoE 6.2c.884: setWiFiWdsAddConfig in /cgi-bin/cstecgi.cgi copies the ApCliKeyStr parameter with sprintf without a bound, causing a buffer overflow. A public PoC exists and requires a logged-in session. No vendor fix is known.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CA300-PoE","fixed":[],"affected":"6.2c.884","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","ca300-poe","embedded-device","infrastructure","totolink","wifi-access-point"],"not_affected_if":["auth-required","different-firmware","management-not-exposed"],"how_to_check":"- Check the firmware version in the device's admin web interface; 6.2c.884 is the only version reported affected.\n- Check whether the web management interface (/cgi-bin/cstecgi.cgi) is reachable from the internet or untrusted networks.\n- Exploitation needs a logged-in session (the public PoC logs in as admin first), so also check for default or weak admin passwords.\n- No vendor fix or workaround is known: restrict management access to a trusted network, change admin credentials, or replace the device. Watch totolink.net downloads for newer CA300-PoE firmware.","fix":null,"status":"open","published_at":"2026-11-07T19:17:28+00:00","first_seen_at":"2026-11-07T19:18:31+00:00","triaged_at":"2026-11-07T19:19:08+00:00","updated_at":"2026-11-07T19:19:57+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-07T19:19:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK CA300-PoE: buffer overflow in Wi-Fi WDS setup lets remote attackers run code","impact":"high","summary":"The TOTOLINK CA300-PoE 6.2c.884 web management CGI (/cgi-bin/cstecgi.cgi, function setWiFiWdsAddConfig) does not bound the ApCliKeyStr argument, so a long value overflows a buffer. A remote attacker can use the publicly disclosed exploit to crash the device or potentially run code on it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["totolink","ca300-poe","wifi-access-point","embedded-device"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker crashes the device or may run code on it","analyst_note":"Confirm the vendor fix version and whether authentication is required for cstecgi.cgi; the sources only give NVD and a generic description.","how_to_check":"- Check the firmware version in the device's admin web interface and see whether it is `6.2c.884`\n- Check whether the device's management interface is reachable from the internet or untrusted networks\n- unknown for a command, as the sources do not give one","plain_action":"","needs_analyst":true,"not_affected_if":["different-firmware","management-not-exposed"],"who_is_affected":"Owners of TOTOLINK CA300-PoE access points running firmware 6.2c.884 are exposed through the device's web management CGI. Exposure is greatest where the management interface is reachable from the internet or from untrusted network segments. Devices not running this firmware or with management access restricted to trusted hosts are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000746,"input_tokens":4260,"output_tokens":640,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the vendor fix version and whether authentication is required for cstecgi.cgi; the sources only give NVD and a generic description.","search":"'-124059':24A,27A '-2026':23A,26A '/cgi-bin/cstecgi.cgi':54B,108C '6.2':5A,50B,95C 'access':44B 'affect':97C 'apclikeystr':57B,114C 'argument':113C 'attack':120C 'auth':32B 'auth-requir':31B 'bound':63B 'buffer':7A,66B,117C 'c.884':6A,51B,96C 'ca300':3A,29A,35B,48B,93C 'ca300-poe':2A,28A,34B,47B,92C 'caus':64B 'copi':55B 'cve':22A,25A 'detect':89C 'devic':39B 'disclos':129C 'embed':38B 'embedded-devic':37B 'exist':71B 'exploit':126C 'fi':12A 'file':107C 'fix':81B 'function':103C 'infrastructur':40B 'initi':123C 'known':83B 'lead':115C 'log':17A,76B 'logged-in':16A,75B 'manipul':110C 'may':121C,132C 'overflow':8A,67B,118C 'paramet':58B 'poc':21A,70B 'poe':4A,30A,36B,49B,94C 'point':45B 'public':20A,69B,130C 'remot':124C 'requir':33B,73B 'secur':85C 'session':78B 'setup':14A 'setwifiwdsaddconfig':52B,104C 'sprintf':60B 'totolink':1A,41B,46B,91C 'use':134C 'user':19A 'vendor':80B 'vulner':86C,100C 'wds':13A 'wi':11A 'wi-fi':10A 'wifi':43B 'wifi-access-point':42B 'without':61B","nicknames":[],"mitigations":[],"who_affected":"Owners of TOTOLINK CA300-PoE access points running firmware 6.2c.884. Exploitation needs an authenticated session on the web management interface (the public PoC logs in first), so exposure is greatest where management is reachable from the internet or untrusted segments, or where admin credentials are default or weak. Devices on other firmware (not reported) or with management restricted to trusted hosts are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ca300poe"],"ptokens":["ca300","poe"],"labels":["authrequired","ca300poe","critical","embeddeddevice","infrastructure","totolink","wifiaccesspoint"],"campaign_type":null,"search_a":"'-124059':24A,27A '-2026':23A,26A '6.2':5A 'buffer':7A 'c.884':6A 'ca300':3A,29A 'ca300-poe':2A,28A 'cve':22A,25A 'fi':12A 'log':17A 'logged-in':16A 'overflow':8A 'poc':21A 'poe':4A,30A 'public':20A 'setup':14A 'totolink':1A 'user':19A 'wds':13A 'wi':11A 'wi-fi':10A","search_b":"'/cgi-bin/cstecgi.cgi':54B '6.2':50B 'access':44B 'apclikeystr':57B 'auth':32B 'auth-requir':31B 'bound':63B 'buffer':66B 'c.884':51B 'ca300':35B,48B 'ca300-poe':34B,47B 'caus':64B 'copi':55B 'devic':39B 'embed':38B 'embedded-devic':37B 'exist':71B 'fix':81B 'infrastructur':40B 'known':83B 'log':76B 'logged-in':75B 'overflow':67B 'paramet':58B 'poc':70B 'poe':36B,49B 'point':45B 'public':69B 'requir':33B,73B 'session':78B 'setwifiwdsaddconfig':52B 'sprintf':60B 'totolink':41B,46B 'vendor':80B 'wifi':43B 'wifi-access-point':42B 'without':61B","search_c":"'/cgi-bin/cstecgi.cgi':108C '6.2':95C 'affect':97C 'apclikeystr':114C 'argument':113C 'attack':120C 'buffer':117C 'c.884':96C 'ca300':93C 'ca300-poe':92C 'detect':89C 'disclos':129C 'exploit':126C 'file':107C 'function':103C 'initi':123C 'lead':115C 'manipul':110C 'may':121C,132C 'overflow':118C 'poe':94C 'public':130C 'remot':124C 'secur':85C 'setwifiwdsaddconfig':104C 'totolink':91C 'use':134C 'vulner':86C,100C","first_public_at":"2026-11-07T19:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-124059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124059","severity":null,"published_at":"2026-11-07T19:17:28+00:00","modified_at":"2026-11-07T19:17:28+00:00","first_seen_at":"2026-11-07T19:18:31+00:00","fetched_at":"2026-11-07T19:18:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124059:2141","url":"https://vuldb.com/vuln/432114","severity":null,"published_at":"2026-11-07T19:19:57+00:00","modified_at":"2026-11-07T19:19:57+00:00","first_seen_at":"2026-11-07T19:19:57+00:00","fetched_at":"2026-11-07T19:19:57+00:00","note":"Read VulDB entry and researcher write-up/PoC (no vendor advisory found). PoC logs in first and sends SESSION_ID cookie; VulDB says authentication needed, so login required (CVSS PR:H). No vendor fix or countermeasure known; fix status not confirmed from a vendor page, left unknown. X skipped (not needed). Siblings same product: CVE-2026-124058, 124057, 123961.","cites":["https://vuldb.com/vuln/432114","https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setWiFiWdsAddConfig-3f953a41781f80488243d24703fa0365"]}],"documents":[{"id":97555,"url":"https://vuldb.com/vuln/432114","title":"VulDB VDB-432114: TOTOLINK CA300-PoE setWiFiWdsAddConfig buffer overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":97556,"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setWiFiWdsAddConfig-3f953a41781f80488243d24703fa0365","title":"Researcher write-up and PoC: CA300-PoE setWiFiWdsAddConfig","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"exploit_sources":[{"type":"poc","url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setWiFiWdsAddConfig-3f953a41781f80488243d24703fa0365"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}