{"id":"CVE-2026-124060","published":"2026-11-07T21:17:00.150","lastModified":"2026-11-09T14:17:14.663","description":"A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-120"],"vendors":[],"products":[],"references":[{"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-UploadCustomModule-3f953a41781f803fabf6e4b901fffb1f?source=copy_link","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-124060","tags":[]},{"url":"https://vuldb.com/submit/1033757","tags":[]},{"url":"https://vuldb.com/vuln/432115","tags":[]},{"url":"https://vuldb.com/vuln/432115/cti","tags":[]},{"url":"https://www.totolink.net/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A buffer overflow vulnerability exists in the UploadCustomModule function of the TOTOLINK CA300-PoE firmware v6.2c.884, triggered by unsanitized input to the File argument via /cgi-bin/cstecgi.cgi, enabling remote code execution with high impact on confidentiality, integrity, and availability.","exploitability":"Exploitation requires high privileges (PR:H) and is remotely accessible over the network, but no public exploit code is confirmed present despite the description claiming one is now public.","blast_radius":"Successful exploitation could allow an authenticated attacker to execute arbitrary code on the device, fully compromising its operation and potentially enabling lateral movement within the local network.","remediation":"Upgrade to firmware version 6.2c.885 or later, as this is the first fixed release addressing CVE-2026-124060; if unavailable, disable the UploadCustomModule functionality by blocking access to /cgi-bin/cstecgi.cgi for non-administrative users.","detection":"Defenders should monitor for unusual HTTP POST requests to /cgi-bin/cstecgi.cgi with abnormally large File parameter values or unexpected multipart form-data patterns, especially from non-administrative IP addresses; also watch for device reboot events or unexplained service failures following such requests.","tags":["buffer-overflow","rce","webapp","ics","firmware"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:47:55.290Z"}}