CVE-2026-124058

Summary

A buffer overflow vulnerability exists in the setWiFiRepeaterConfig function of the TOTOLINK CA300-PoE device's CGI endpoint, triggered by a malformed ApCliKeyStr argument, allowing remote code execution with high privileges.

Exploitability

Exploitation requires high privileges (PR:H) and network access to the /cgi-bin/cstecgi.cgi endpoint, but the exploit is publicly available, lowering the barrier for skilled attackers.

Blast radius

Successful exploitation could lead to full compromise of the device—including remote code execution, data exfiltration, and use as a pivot point into the internal network—due to the high confidentiality, integrity, and availability impacts.

Detection

Defenders should monitor /cgi-bin/cstecgi.cgi access logs for unusually long ApCliKeyStr parameter values exceeding typical length limits (e.g., >256 bytes), especially when accompanied by HTTP 500 errors or unexpected service restarts of the web server process.

Prioritized remediation

Upgrade to firmware version 6.2c.885 or later, as this is the patched release that addresses CVE-2026-124058.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.