CVE-2026-124057: TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow

Published Nov 7, 2026

Updated

A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument Key1Str1 results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Event History

Nov 7, 2026

CVE Published

via MITRE·05:45 PM

Data Sourced

via MITRE·05:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack can be initiated remotely. The available information does not state whether authentication or access to a management network is required.

Is public exploit code available?

Yes. The vulnerability is flagged as having a proof of concept, and the description states that an exploit has been released publicly.

Which component should be prioritized for investigation?

Investigate the cstecgi.cgi CGI endpoint, specifically its setWiFiMultipleConfig function and handling of the Key1Str1 argument. The reported issue is a buffer overflow triggered through manipulation of that argument.

CVE-2026-124057: TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Is public exploit code available?

Which component should be prioritized for investigation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Is public exploit code available?

Which component should be prioritized for investigation?