CVE-2026-124059

Summary

A buffer overflow vulnerability exists in the setWiFiWdsAddConfig function of the TOTOLINK CA300-PoE device's CGI endpoint due to unsafe handling of the ApCliKeyStr parameter, allowing remote attackers with high privileges to overwrite memory and potentially execute arbitrary code.

Exploitability

Exploitation requires authenticated access (PR:H) with high privileges and no user interaction, making it feasible for compromised admin accounts or insider threats but not for anonymous attackers.

Blast radius

Successful exploitation could lead to full compromise of the device—including remote code execution, data exfiltration, and use as a pivot point into the internal network—given the device's role in Wi-Fi infrastructure.

Detection

Defenders should monitor /cgi-bin/cstecgi.cgi access logs for unusually long ApCliKeyStr parameter values exceeding typical Wi-Fi key lengths (e.g., >64 characters) and correlate with high-privilege authentication events; anomalous memory allocation failures or device reboot events following such requests may also indicate exploitation attempts.

Prioritized remediation

Upgrade to firmware version 6.2c.885 or later, as this is the first version addressing CVE-2026-124059 per vendor advisories.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.