{"id":"CVE-2026-123961","published":"2026-11-07T11:17:01.290","lastModified":"2026-11-09T14:17:13.723","description":"A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument KeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-120"],"vendors":[],"products":[],"references":[{"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setWiFiBasicConfig-3f953a41781f8098a6e8d808cb1a3ffd?source=copy_link","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-123961","tags":[]},{"url":"https://vuldb.com/submit/1033753","tags":[]},{"url":"https://vuldb.com/vuln/432024","tags":[]},{"url":"https://vuldb.com/vuln/432024/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A buffer overflow vulnerability exists in the setWiFiBasicConfig function of the TOTOLINK CA300-PoE firmware v6.2c.884, triggered by a malformed KeyStr parameter passed to /cgi-bin/cstecgi.cgi. This allows remote attackers with low-privileged access to overwrite memory and potentially execute arbitrary code.","exploitability":"Exploitation requires low-privileged network access (PR:L) and is straightforward due to the lack of authentication complexity (AC:L) and user interaction (UI:N); a public exploit exists.","blast_radius":"Successful exploitation could lead to full system compromise including remote code execution, data theft, and service disruption across the affected device and potentially the connected network.","remediation":"TOTOLINK has not released a fixed firmware version as of the description; disable the affected /cgi-bin/cstecgi.cgi endpoint or restrict access to it via ACLs until a patch is available.","detection":"Defenders should monitor for unusual POST requests to /cgi-bin/cstecgi.cgi with abnormally long KeyStr values (e.g., >256 bytes) and unexpected memory-related crashes or restarts of the device’s web service in logs. No reliable network or host indicator is derivable from the published description.","tags":["buffer-overflow","rce","web","embedded","ics"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:45:31.088Z"}}