CVE-2026-123958: TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow

Published Nov 7, 2026

Updated

A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument lanDns/lanSecDns/langType leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Event History

Nov 7, 2026

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What inputs are involved in the vulnerable request?

The buffer overflow is triggered by manipulating the lanDns, lanSecDns, or langType arguments handled by the setLanConfig function in /cgi-bin/cstecgi.cgi.

Can this be exploited over the network?

Yes. The vulnerability can be attacked remotely.

Is exploit code available?

Yes. A public proof of concept is available, which may make exploitation easier for attackers.

CVE-2026-123958: TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow

Event History

Frequently Asked Questions

What inputs are involved in the vulnerable request?

Can this be exploited over the network?

Is exploit code available?

Company

Resources

Contact

Frequently Asked Questions

What inputs are involved in the vulnerable request?

Can this be exploited over the network?

Is exploit code available?