CVE-2026-123957: TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow

Published Nov 7, 2026

Updated

A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Event History

Nov 7, 2026

CVE Published

via MITRE·08:15 AM

Data Sourced

via MITRE·08:15 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue can be initiated remotely through the affected cstecgi.cgi endpoint. The available information does not state whether authentication, local-network access, or Internet exposure is required.

Is exploit code available?

Yes. A proof of concept has been publicly disclosed, so attackers may be able to use it.

CVE-2026-123957: TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Is exploit code available?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Is exploit code available?