{"id":"CVE-2026-123957","published":"2026-11-07T09:17:14.890","lastModified":"2026-11-09T14:17:13.553","description":"A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-120"],"vendors":[],"products":[],"references":[{"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setIpQosRules-3f953a41781f801195e5e07dfe7488b9?source=copy_link","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-123957","tags":[]},{"url":"https://vuldb.com/submit/1033672","tags":[]},{"url":"https://vuldb.com/vuln/432020","tags":[]},{"url":"https://vuldb.com/vuln/432020/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A buffer overflow in the setIpQosRules function of the TOTOLINK CA300-PoE router's /cgi-bin/cstecgi.cgi endpoint allows remote attackers to overwrite memory via the ipStart parameter, potentially leading to arbitrary code execution.","exploitability":"Exploitation requires low privileges (authenticated user) and no user interaction; the attack is initiated remotely over the network.","blast_radius":"Successful exploitation could allow full compromise of the device—including remote code execution, data exfiltration, or use as a pivot point—given the high CVSS score and lack of authentication complexity.","remediation":"Upgrade to firmware version 6.2c.885 or later, as this is the first fixed version following the vulnerable 6.2c.884 release.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["buffer-overflow","rce","web","embedded","iot"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:47:48.086Z"}}