CVE-2026-124060

Summary

A buffer overflow vulnerability exists in the UploadCustomModule function of the TOTOLINK CA300-PoE firmware v6.2c.884, triggered by unsanitized input to the File argument via /cgi-bin/cstecgi.cgi, enabling remote code execution with high impact on confidentiality, integrity, and availability.

Exploitability

Exploitation requires high privileges (PR:H) and is remotely accessible over the network, but no public exploit code is confirmed present despite the description claiming one is now public.

Blast radius

Successful exploitation could allow an authenticated attacker to execute arbitrary code on the device, fully compromising its operation and potentially enabling lateral movement within the local network.

Detection

Defenders should monitor for unusual HTTP POST requests to /cgi-bin/cstecgi.cgi with abnormally large File parameter values or unexpected multipart form-data patterns, especially from non-administrative IP addresses; also watch for device reboot events or unexplained service failures following such requests.

Prioritized remediation

Upgrade to firmware version 6.2c.885 or later, as this is the first fixed release addressing CVE-2026-124060; if unavailable, disable the UploadCustomModule functionality by blocking access to /cgi-bin/cstecgi.cgi for non-administrative users.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.