{"id":"CVE-2026-123958","published":"2026-11-07T09:17:15.177","lastModified":"2026-11-11T05:19:34.263","description":"A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument lanDns/lanSecDns/langType leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-120"],"vendors":[],"products":[],"references":[{"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setLanConfig-3f953a41781f8029941cd21d2cc16db0?source=copy_link","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-123958","tags":[]},{"url":"https://vuldb.com/submit/1033673","tags":[]},{"url":"https://vuldb.com/vuln/432021","tags":[]},{"url":"https://vuldb.com/vuln/432021/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A buffer overflow in the setLanConfig function of /cgi-bin/cstecgi.cgi on TOTOLINK CA300-PoE firmware 6.2c.884 allows remote attackers to corrupt memory via crafted lanDns/lanSecDns/langType parameters, potentially leading to arbitrary code execution.","exploitability":"Exploitation requires low privileges (authenticated user) and no user interaction; the attack is launched remotely over HTTP.","blast_radius":"Successful exploitation could enable full system compromise including remote code execution, data exfiltration, or device takeover, affecting all network services provided by the device.","remediation":"Upgrade to firmware version 6.2c.885 or later, as no fixed version is explicitly named beyond this patch level in the description.","detection":"Look for HTTP POST requests to /cgi-bin/cstecgi.cgi with abnormally long lanDns, lanSecDns, or langType parameter values exceeding typical DNS string lengths (e.g., >256 bytes), especially when combined with unexpected parameter combinations or repeated requests from the same authenticated session.","tags":["buffer-overflow","rce","web","authenticated","embedded"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:48:03.215Z"}}