CVE-2026-123960

Summary

A buffer overflow vulnerability exists in the setWanConfig function of the TOTOLINK CA300-PoE firmware v6.2c.884, triggered via malformed inputs to pppoeUser, priDns, or secDns parameters in /cgi-bin/cstecgi.cgi. This allows remote attackers with low privileges to execute arbitrary code by overwriting memory beyond buffer boundaries.

Exploitability

Exploitation requires only network access and valid low-privilege credentials (PR:L), with no user interaction needed, making it highly exploitable by automated tools.

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption across the affected device and potentially connected network segments.

Detection

Defenders should monitor for repeated HTTP POST requests to /cgi-bin/cstecgi.cgi with abnormally long pppoeUser, priDns, or secDns parameter values (e.g., >256 characters), especially when accompanied by HTTP 500 errors or unexpected service restarts in device logs. No reliable host-level artefacts are described.

Prioritized remediation

Upgrade to firmware version 6.2c.885 or later, as this is the first patched version addressing the buffer overflow in setWanConfig; if unavailable, disable PPPoE configuration via the /cgi-bin/cstecgi.cgi endpoint and restrict access to trusted IPs only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.