{"id":"CVE-2026-124060","kind":"vulnerability","aliases":["CVE-2026-124060"],"related":[],"title":"TOTOLINK CA300-PoE: remote buffer overflow in firmware upload function","description":"A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.","summary":"VulDB reports a buffer overflow in the UploadCustomModule handler of /cgi-bin/cstecgi.cgi on TOTOLINK CA300-PoE 6.2c.884, triggered by the File argument. A public proof of concept exists. VulDB lists no countermeasure, and no TOTOLINK advisory or fixed firmware was found. VulDB says exploitation needs authentication.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CA300-PoE","fixed":[],"affected":"6.2c.884","ecosystem":"vendor"}],"ecosystems":[],"tags":["ca300-poe","embedded","infrastructure","routers-access-points","totolink"],"not_affected_if":["management-interface-restricted","other-firmware"],"how_to_check":"- Check the firmware version in the device admin page: 6.2c.884 is the version reported vulnerable. Other versions are untested, not cleared.\n- Check whether the web management interface (/cgi-bin/cstecgi.cgi) is reachable from the internet or untrusted networks.\n- Also check other TOTOLINK models sharing the cstecgi.cgi code (UploadCustomModule overflows were reported earlier in other models); nothing confirms they are affected by this CVE.","fix":null,"status":"open","published_at":"2026-11-07T21:17:00+00:00","first_seen_at":"2026-11-07T21:18:43+00:00","triaged_at":"2026-11-07T21:20:05+00:00","updated_at":"2026-11-07T21:20:45+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T21:20:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK CA300-PoE: remote buffer overflow in firmware upload function","impact":"high","summary":"The TOTOLINK CA300-PoE 6.2c.884 web interface has a buffer overflow in its UploadCustomModule handler at /cgi-bin/cstecgi.cgi, triggered by the File argument. A remote attacker can send a crafted request to overwrite memory on the device, and a public exploit exists.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["totolink","ca300-poe","embedded","routers-access-points"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker may run code on the device remotely","analyst_note":"Check the TOTOLINK vendor advisory or firmware page for a fixed version and whether authentication is required for UploadCustomModule; the NVD entry alone does not say.","how_to_check":"- Check the firmware version in the device admin page against `6.2c.884`\n- Check whether the web management interface is reachable from the internet or untrusted networks\n- unknown for any vendor-published fixed version","plain_action":"","needs_analyst":true,"not_affected_if":["other-firmware","management-interface-restricted"],"who_is_affected":"Any TOTOLINK CA300-PoE access point running firmware 6.2c.884 with its web management interface reachable over the network is potentially exposed. Devices with the management interface restricted to a trusted internal network, or not in use, carry much less risk. The sources do not state whether authentication is required before the vulnerable handler is reached.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000727,"input_tokens":4232,"output_tokens":608,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the TOTOLINK vendor advisory or firmware page for a fixed version and whether authentication is required for UploadCustomModule; the NVD entry alone does not say.","search":"'-124060':14A,17A '-2026':13A,16A '/cgi-bin/cstecgi.cgi':41B,100C '6.2':47B,87C 'access':28B 'advisori':67B 'affect':89C 'argument':53B,105C 'attack':112C 'authent':77B 'buffer':6A,34B,109C 'c.884':48B,88C 'ca300':3A,19A,22B,45B,85C 'ca300-poe':2A,18A,21B,44B,84C 'concept':58B 'countermeasur':63B 'cve':12A,15A 'detect':81C 'embed':24B 'exist':59B 'exploit':75B,118C 'file':52B,99C,106C 'firmwar':9A,70B 'fix':69B 'found':72B 'function':11A,95C 'handler':39B 'infrastructur':25B 'issu':92C 'launch':115C 'list':61B 'manipul':102C 'may':113C,123C 'need':76B 'overflow':7A,35B,110C 'poe':4A,20A,23B,46B,86C 'point':29B 'proof':56B 'public':55B,121C 'remot':5A,116C 'report':32B 'result':107C 'router':27B 'routers-access-point':26B 'say':74B 'totolink':1A,30B,43B,66B,83C 'trigger':49B 'upload':10A 'uploadcustommodul':38B,96C 'use':125C 'vuldb':31B,60B,73B 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"TOTOLINK CA300-PoE access points running firmware 6.2c.884 whose web management interface can be reached over the network. VulDB says exploitation needs authentication (the CVSS vector also shows privileges required: high), so devices with a strong admin password and a management interface limited to a trusted network carry much less risk. No fix is known.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ca300poe"],"ptokens":["ca300","poe"],"labels":["ca300poe","critical","embedded","infrastructure","routersaccesspoints","totolink"],"campaign_type":null,"search_a":"'-124060':14A,17A '-2026':13A,16A 'buffer':6A 'ca300':3A,19A 'ca300-poe':2A,18A 'cve':12A,15A 'firmwar':9A 'function':11A 'overflow':7A 'poe':4A,20A 'remot':5A 'totolink':1A 'upload':10A","search_b":"'/cgi-bin/cstecgi.cgi':41B '6.2':47B 'access':28B 'advisori':67B 'argument':53B 'authent':77B 'buffer':34B 'c.884':48B 'ca300':22B,45B 'ca300-poe':21B,44B 'concept':58B 'countermeasur':63B 'embed':24B 'exist':59B 'exploit':75B 'file':52B 'firmwar':70B 'fix':69B 'found':72B 'handler':39B 'infrastructur':25B 'list':61B 'need':76B 'overflow':35B 'poe':23B,46B 'point':29B 'proof':56B 'public':55B 'report':32B 'router':27B 'routers-access-point':26B 'say':74B 'totolink':30B,43B,66B 'trigger':49B 'uploadcustommodul':38B 'vuldb':31B,60B,73B","search_c":"'/cgi-bin/cstecgi.cgi':100C '6.2':87C 'affect':89C 'argument':105C 'attack':112C 'buffer':109C 'c.884':88C 'ca300':85C 'ca300-poe':84C 'detect':81C 'exploit':118C 'file':99C,106C 'function':95C 'issu':92C 'launch':115C 'manipul':102C 'may':113C,123C 'overflow':110C 'poe':86C 'public':121C 'remot':116C 'result':107C 'totolink':83C 'uploadcustommodul':96C 'use':125C 'vulner':79C","first_public_at":"2026-11-07T21:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124060","severity":null,"published_at":"2026-11-07T21:17:00+00:00","modified_at":"2026-11-07T21:17:00+00:00","first_seen_at":"2026-11-07T21:18:43+00:00","fetched_at":"2026-11-07T21:18:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124060:2146","url":"https://vuldb.com/vuln/432115","severity":null,"published_at":"2026-11-07T21:20:45+00:00","modified_at":"2026-11-07T21:20:45+00:00","first_seen_at":"2026-11-07T21:20:45+00:00","fetched_at":"2026-11-07T21:20:45+00:00","note":"No TOTOLINK advisory or fixed firmware found; only VulDB (VDB-432115, says no countermeasures known, PoC at a Notion page, requires authentication per VulDB 'enhanced level of authentication', CVSS v4 vector PR:H) and the researcher submission. Fix left unknown, not marked none, since no vendor page says so. Not verified: no primary vendor source.","cites":["https://vuldb.com/vuln/432115","https://vuldb.com/submit/1033757"]}],"documents":[{"id":98026,"url":"https://vuldb.com/vuln/432115","title":"VulDB VDB-432115: TOTOLINK CA300-PoE UploadCustomModule File buffer overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":98027,"url":"https://vuldb.com/submit/1033757","title":"VulDB Submit #1033757 (researcher report)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}