CVE-2026-123957 is a critical-rated (CVSS 3.1: 9.9), remotely triggerable buffer overflow in TOTOLINK CA300-PoE firmware 6.2c.884, and a public exploit has already been disclosed.
What Is It
The flaw is in the setIpQosRules function of /cgi-bin/cstecgi.cgi on the TOTOLINK CA300-PoE. A crafted value in the ipStart argument causes a buffer overflow. The weaknesses are classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
VulDB, the CNA, published the CVE on 2026-11-07. NVD currently lists it with a status of "Deferred."
Why It Matters
- Remote attack: The vulnerability can be exploited over the network.
- Low complexity: Attack complexity is Low, and no user interaction is needed. The attacker needs low-level privileges.
- Severe impact: The CVSS 3.1 vector (
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as High, with a Changed scope. That puts the base score at 9.9 (Critical). CVSS 4.0 gives 8.6 (High), with High impact to both the vulnerable system and subsequent systems. CVSS 2.0 gives 9.0. - Public exploit: The description says the exploit "has been publicly disclosed and may be utilized." The CVSS 4.0 data lists exploit maturity as Proof-of-Concept.
The CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation in the wild. Even so, a public PoC for a remotely reachable device makes exploitation easier.
What's Vulnerable
- Vendor: TOTOLINK
- Product: CA300-PoE
- Affected version: 6.2c.884
- CPE:
cpe:2.3:o:totolink:ca300-poe_firmware:*:*:*:*:*:*:*:* - Component:
/cgi-bin/cstecgi.cgi, functionsetIpQosRules, parameteripStart
Patch Status
The source records do not mention a vendor patch, fixed firmware version or official advisory. Because the CVE is not in the KEV catalog, there is no CISA-mandated required action or due date. Owners of affected CA300-PoE devices should check the TOTOLINK website for firmware updates and follow the VulDB entries for changes.