CA300-POE · CVE-2026-124060 · Infrastructure
NO FIX YET
VulDB reports a buffer overflow in the UploadCustomModule handler of /cgi-bin/cstecgi.cgi on TOTOLINK CA300-PoE 6.2c.884, triggered by the File argument. A public proof of concept exists. VulDB lists no countermeasure, and no TOTOLINK advisory or fixed firmware was found. VulDB says exploitation needs authentication.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
TOTOLINK CA300-PoE access points running firmware 6.2c.884 whose web management interface can be reached over the network. VulDB says exploitation needs authentication (the CVSS vector also shows privileges required: high), so devices with a strong admin password and a management interface limited to a trusted network carry much less risk. No fix is known.
Not affected if management-interface-restricted, other-firmware
Who cares ca300-poe, embedded, routers-access-points, totolink
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.