CVE-2026-123959: TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow
A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument langType results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running TOTOLINK CA300-PoE version 6.2c.884 are identified as affected. The vulnerable CGI endpoint can be attacked remotely.
What does an attacker need to exploit it?
An attacker needs to send a crafted value for the langType argument to the setLanguageCfg function in /cgi-bin/cstecgi.cgi. The available information does not state that authentication or local access is required.
How mature is exploitation?
A public exploit has been released, so exploitation may be used in attacks.