TOTOLINK CA300-PoE: Remote buffer overflow in cstecgi.cgi (CVE-2026-124059)
TOTOLINK CA300-PoE version 6.2c.884 contains a remote buffer overflow vulnerability in the setWiFiWdsAddConfig function of /cgi-bin/cstecgi.cgi that allows authenticated attackers with high privileges to trigger memory corruption.
CVE search metadata
CVE search record: CVE-2026-124059. Severity: critical. CVSS: 9.1. KEV: no. Product: CA300-PoE (6.2c.884). Brief: TOTOLINK CA300-PoE: Remote buffer overflow in cstecgi.cgi (CVE-2026-124059). Brief link: https://feed.craftedsignal.io/briefs/2026-11-totolink-buffer-overflow-01b187fa/
Triage facts
Revision 1- Applicability
- CA300-PoE (6.2c.884)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 7, 22:10 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Likely
A remote buffer overflow vulnerability (CVE-2026-124059) exists in the TOTOLINK CA300-PoE firmware version 6.2c.884. The vulnerability is triggered via the setWiFiWdsAddConfig function within the /cgi-bin/cstecgi.cgi script. An attacker with high privileges can manipulate the ApCliKeyStr argument to induce a buffer overflow. Publicly available exploit code has been disclosed, increasing the risk of exploitation.
Impact
Successful exploitation may result in memory corruption, potentially leading to unauthorized code execution or denial of service on the affected network device. The CVSS 4.0 score is 9.4, reflecting high impact on confidentiality, integrity, and availability.
Recommendation
- Inventory all TOTOLINK CA300-PoE devices within the environment.
- Restrict administrative access to the device management interface (cstecgi.cgi) to trusted IP addresses or internal subnets only.
- Monitor for unauthorized administrative access or attempts to access /cgi-bin/cstecgi.cgi with unusual parameters.
- Disable unnecessary services, such as WDS (Wireless Distribution System) configurations, if not required for network operations.
- Consult the vendor for firmware updates addressing this vulnerability.
Immediate actions
Restrict access to the device web management interface to known internal administrative ranges.
Threat Hunt
Identify unauthorized access to /cgi-bin/cstecgi.cgi on internal network devices.
Data: Web server access logs from network appliances, Firewall logs for internal administrative management traffic
Mitigations
Apply firmware patches as provided by TOTOLINK when available.
CVE-2026-124059