CVE-2026-123958

Summary

A buffer overflow in the setLanConfig function of /cgi-bin/cstecgi.cgi on TOTOLINK CA300-PoE firmware 6.2c.884 allows remote attackers to corrupt memory via crafted lanDns/lanSecDns/langType parameters, potentially leading to arbitrary code execution.

Exploitability

Exploitation requires low privileges (authenticated user) and no user interaction; the attack is launched remotely over HTTP.

Blast radius

Successful exploitation could enable full system compromise including remote code execution, data exfiltration, or device takeover, affecting all network services provided by the device.

Detection

Look for HTTP POST requests to /cgi-bin/cstecgi.cgi with abnormally long lanDns, lanSecDns, or langType parameter values exceeding typical DNS string lengths (e.g., >256 bytes), especially when combined with unexpected parameter combinations or repeated requests from the same authenticated session.

Prioritized remediation

Upgrade to firmware version 6.2c.885 or later, as no fixed version is explicitly named beyond this patch level in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.