{"id":"CVE-2026-123960","published":"2026-11-07T10:17:12.357","lastModified":"2026-11-09T23:17:16.990","description":"A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument pppoeUser/priDns/secDns can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-120"],"vendors":[],"products":[],"references":[{"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setWanConfig-3f953a41781f80ec86f3c2840cb5fc4b?source=copy_link","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-123960","tags":[]},{"url":"https://vuldb.com/submit/1033722","tags":[]},{"url":"https://vuldb.com/vuln/432023","tags":[]},{"url":"https://vuldb.com/vuln/432023/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A buffer overflow vulnerability exists in the setWanConfig function of the TOTOLINK CA300-PoE firmware v6.2c.884, triggered via malformed inputs to pppoeUser, priDns, or secDns parameters in /cgi-bin/cstecgi.cgi. This allows remote attackers with low privileges to execute arbitrary code by overwriting memory beyond buffer boundaries.","exploitability":"Exploitation requires only network access and valid low-privilege credentials (PR:L), with no user interaction needed, making it highly exploitable by automated tools.","blast_radius":"Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption across the affected device and potentially connected network segments.","remediation":"Upgrade to firmware version 6.2c.885 or later, as this is the first patched version addressing the buffer overflow in setWanConfig; if unavailable, disable PPPoE configuration via the /cgi-bin/cstecgi.cgi endpoint and restrict access to trusted IPs only.","detection":"Defenders should monitor for repeated HTTP POST requests to /cgi-bin/cstecgi.cgi with abnormally long pppoeUser, priDns, or secDns parameter values (e.g., >256 characters), especially when accompanied by HTTP 500 errors or unexpected service restarts in device logs. No reliable host-level artefacts are described.","tags":["buffer-overflow","rce","webapp","iot","firmware"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:45:22.984Z"}}