CVE-2026-124059: TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow
A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this vulnerability is the function setWiFiWdsAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ApCliKeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Devices running TOTOLINK CA300-PoE firmware version 6.2c.884 are identified as affected. The vulnerable functionality is exposed through the device's cstecgi.cgi CGI endpoint.
What does an attacker need to exploit it?
The attack can be initiated remotely by manipulating the ApCliKeyStr argument supplied to the setWiFiWdsAddConfig function. No additional prerequisites are stated in the available information.
Is public exploit information available?
Yes. A proof of concept is flagged, and the exploit has been publicly disclosed, which may increase the likelihood of attempted exploitation.