---
id: "CVE-2026-124060"
page: "https://infrastack.ai/live/CVE-2026-124060"
kind: "vulnerability"
aliases: ["CVE-2026-124060"]
title: "TOTOLINK CA300-PoE: remote buffer overflow in firmware upload function"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "CA300-PoE", "fixed": [], "affected": "6.2c.884", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ca300-poe", "embedded", "infrastructure", "routers-access-points", "totolink"]
not_affected_if: ["management-interface-restricted", "other-firmware"]
published_at: "2026-11-07T21:17:00+00:00"
first_seen_at: "2026-11-07T21:18:43+00:00"
updated_at: "2026-11-07T21:20:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124060", "first_seen_at": "2026-11-07T21:18:43+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/432115", "first_seen_at": "2026-11-07T21:20:45+00:00", "cites": ["https://vuldb.com/vuln/432115", "https://vuldb.com/submit/1033757"]}]
exploit_sources: []
---

# TOTOLINK CA300-PoE: remote buffer overflow in firmware upload function

Link for people: https://infrastack.ai/live/CVE-2026-124060 (this .md is for agents)

VulDB reports a buffer overflow in the UploadCustomModule handler of /cgi-bin/cstecgi.cgi on TOTOLINK CA300-PoE 6.2c.884, triggered by the File argument. A public proof of concept exists. VulDB lists no countermeasure, and no TOTOLINK advisory or fixed firmware was found. VulDB says exploitation needs authentication.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CA300-PoE affected 6.2c.884 fixed no fixed version listed

## How to check

- Check the firmware version in the device admin page: 6.2c.884 is the version reported vulnerable. Other versions are untested, not cleared.
- Check whether the web management interface (/cgi-bin/cstecgi.cgi) is reachable from the internet or untrusted networks.
- Also check other TOTOLINK models sharing the cstecgi.cgi code (UploadCustomModule overflows were reported earlier in other models); nothing confirms they are affected by this CVE.

## Timeline

- 2026-11-07T21:18:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124060
- 2026-11-07T21:20:45+00:00 analyst https://vuldb.com/vuln/432115 — No TOTOLINK advisory or fixed firmware found; only VulDB (VDB-432115, says no countermeasures known, PoC at a Notion page, requires authentication per VulDB 'enhanced level of authentication', CVSS v4 vector PR:H) and the researcher submission. Fix left unknown, not marked none, since no vendor page says so. Not verified: no primary vendor source.

## Documents

- [advisory] VulDB VDB-432115: TOTOLINK CA300-PoE UploadCustomModule File buffer overflow https://vuldb.com/vuln/432115
- [describes] VulDB Submit #1033757 (researcher report) https://vuldb.com/submit/1033757

## From the sources

A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_