CVE-2026-123959

Summary

A buffer overflow vulnerability exists in the setLanguageCfg function of the TOTOLINK CA300-PoE device's CGI endpoint, triggered by manipulation of the langType parameter, allowing remote attackers to corrupt memory and potentially execute arbitrary code.

Exploitability

Exploitation requires high privileges (PR:H) and network access to the /cgi-bin/cstecgi.cgi endpoint, but the exploit is publicly available, lowering the barrier for skilled attackers.

Blast radius

Successful exploitation could lead to full compromise of the device—including remote code execution, data exfiltration, and use as a pivot point—given the CVSS 9.1 score and C/CWE-119/120 characteristics.

Detection

Defenders should monitor for anomalous HTTP POST requests to /cgi-bin/cstecgi.cgi with abnormally long langType values (e.g., >256 bytes) or repeated requests from a single source targeting the setLanguageCfg action; such patterns may indicate exploitation attempts.

Prioritized remediation

Upgrade to firmware version 6.2c.885 or later, as this is the patched release addressing CVE-2026-123959 per vendor advisories.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.