---
id: "CVE-2026-124059"
page: "https://infrastack.ai/live/CVE-2026-124059"
kind: "vulnerability"
aliases: ["CVE-2026-124059"]
title: "TOTOLINK CA300-PoE 6.2c.884: buffer overflow in Wi-Fi WDS setup for logged-in users, public PoC"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "CA300-PoE", "fixed": [], "affected": "6.2c.884", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "ca300-poe", "embedded-device", "infrastructure", "totolink", "wifi-access-point"]
not_affected_if: ["auth-required", "different-firmware", "management-not-exposed"]
published_at: "2026-11-07T19:17:28+00:00"
first_seen_at: "2026-11-07T19:18:31+00:00"
updated_at: "2026-11-07T19:19:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124059", "first_seen_at": "2026-11-07T19:18:31+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/432114", "first_seen_at": "2026-11-07T19:19:57+00:00", "cites": ["https://vuldb.com/vuln/432114", "https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setWiFiWdsAddConfig-3f953a41781f80488243d24703fa0365"]}]
exploit_sources: [{"type": "poc", "url": "https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setWiFiWdsAddConfig-3f953a41781f80488243d24703fa0365"}]
---

# TOTOLINK CA300-PoE 6.2c.884: buffer overflow in Wi-Fi WDS setup for logged-in users, public PoC

Link for people: https://infrastack.ai/live/CVE-2026-124059 (this .md is for agents)

TOTOLINK CA300-PoE 6.2c.884: setWiFiWdsAddConfig in /cgi-bin/cstecgi.cgi copies the ApCliKeyStr parameter with sprintf without a bound, causing a buffer overflow. A public PoC exists and requires a logged-in session. No vendor fix is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CA300-PoE affected 6.2c.884 fixed no fixed version listed

## How to check

- Check the firmware version in the device's admin web interface; 6.2c.884 is the only version reported affected.
- Check whether the web management interface (/cgi-bin/cstecgi.cgi) is reachable from the internet or untrusted networks.
- Exploitation needs a logged-in session (the public PoC logs in as admin first), so also check for default or weak admin passwords.
- No vendor fix or workaround is known: restrict management access to a trusted network, change admin credentials, or replace the device. Watch totolink.net downloads for newer CA300-PoE firmware.

## Timeline

- 2026-11-07T19:18:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124059
- 2026-11-07T19:19:57+00:00 analyst https://vuldb.com/vuln/432114 — Read VulDB entry and researcher write-up/PoC (no vendor advisory found). PoC logs in first and sends SESSION_ID cookie; VulDB says authentication needed, so login required (CVSS PR:H). No vendor fix or countermeasure known; fix status not confirmed from a vendor page, left unknown. X skipped (not needed). Siblings same product: CVE-2026-124058, 124057, 123961.

## Documents

- [advisory] VulDB VDB-432114: TOTOLINK CA300-PoE setWiFiWdsAddConfig buffer overflow https://vuldb.com/vuln/432114
- [poc] Researcher write-up and PoC: CA300-PoE setWiFiWdsAddConfig https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setWiFiWdsAddConfig-3f953a41781f80488243d24703fa0365

## From the sources

A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this vulnerability is the function setWiFiWdsAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ApCliKeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_