{"id":"CVE-2026-124058","published":"2026-11-07T19:17:28.263","lastModified":"2026-11-07T19:17:28.427","description":"A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-120"],"vendors":[],"products":[],"references":[{"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setWiFiRepeaterConfig-3f953a41781f80349879d9aca7c4702a?source=copy_link","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-124058","tags":[]},{"url":"https://vuldb.com/submit/1033755","tags":[]},{"url":"https://vuldb.com/vuln/432113","tags":[]},{"url":"https://vuldb.com/vuln/432113/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A buffer overflow vulnerability exists in the setWiFiRepeaterConfig function of the TOTOLINK CA300-PoE device's CGI endpoint, triggered by a malformed ApCliKeyStr argument, allowing remote code execution with high privileges.","exploitability":"Exploitation requires high privileges (PR:H) and network access to the /cgi-bin/cstecgi.cgi endpoint, but the exploit is publicly available, lowering the barrier for skilled attackers.","blast_radius":"Successful exploitation could lead to full compromise of the device—including remote code execution, data exfiltration, and use as a pivot point into the internal network—due to the high confidentiality, integrity, and availability impacts.","remediation":"Upgrade to firmware version 6.2c.885 or later, as this is the patched release that addresses CVE-2026-124058.","detection":"Defenders should monitor /cgi-bin/cstecgi.cgi access logs for unusually long ApCliKeyStr parameter values exceeding typical length limits (e.g., >256 bytes), especially when accompanied by HTTP 500 errors or unexpected service restarts of the web server process.","tags":["buffer-overflow","rce","web","embedded","ics"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:47:38.785Z"}}