CVE-2026-123961

Summary

A buffer overflow vulnerability exists in the setWiFiBasicConfig function of the TOTOLINK CA300-PoE firmware v6.2c.884, triggered by a malformed KeyStr parameter passed to /cgi-bin/cstecgi.cgi. This allows remote attackers with low-privileged access to overwrite memory and potentially execute arbitrary code.

Exploitability

Exploitation requires low-privileged network access (PR:L) and is straightforward due to the lack of authentication complexity (AC:L) and user interaction (UI:N); a public exploit exists.

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, data theft, and service disruption across the affected device and potentially the connected network.

Detection

Defenders should monitor for unusual POST requests to /cgi-bin/cstecgi.cgi with abnormally long KeyStr values (e.g., >256 bytes) and unexpected memory-related crashes or restarts of the device’s web service in logs. No reliable network or host indicator is derivable from the published description.

Prioritized remediation

TOTOLINK has not released a fixed firmware version as of the description; disable the affected /cgi-bin/cstecgi.cgi endpoint or restrict access to it via ACLs until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.