CVE-2026-123958: Remote Buffer Overflow in TOTOLINK CA300-PoE setLanConfig

"A critical remote buffer overflow in TOTOLINK CA300-PoE firmware 6.2c.884 can be triggered through the `setLanConfig` function, and a public exploit is available."

A critical remote buffer overflow in TOTOLINK CA300-PoE firmware 6.2c.884 can be triggered through the setLanConfig function, and a public exploit is available.

What Is It

CVE-2026-123958 is a buffer overflow in the setLanConfig function of /cgi-bin/cstecgi.cgi on the TOTOLINK CA300-PoE. Changing the lanDns, lanSecDns or langType arguments in a request to this endpoint causes the overflow. The weakness is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input, the classic buffer overflow).

VulDB, the CNA, published the CVE on 2026-11-07. NVD currently lists its status as "Deferred" (see the NVD entry in Sources).

Why It Matters

CVSS 3.1: 9.9 (Critical). Vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
CVSS 4.0: 8.6 (High). Exploit maturity is rated Proof-of-Concept.
CVSS 2.0: 9.0 (High).

An attacker can exploit this remotely over the network. The attack is low in complexity and needs no user interaction, but it does need low-level privileges, meaning some form of authenticated access. Confidentiality, integrity and availability impacts are all rated High. The scope is "Changed," so the impact can reach beyond the vulnerable component.

The CVE description says the exploit "is publicly available and might be used." A researcher write-up for this issue is linked in the references.

KEV status: CVE-2026-123958 is not in the CISA Known Exploited Vulnerabilities catalog. CISA has not confirmed active exploitation, and there is no KEV-mandated required action or due date.

What's Vulnerable

Vendor: TOTOLINK
Product: CA300-PoE
Affected version: 6.2c.884
CPE: cpe:2.3:o:totolink:ca300-poe_firmware:*:*:*:*:*:*:*:*
Affected component: setLanConfig in /cgi-bin/cstecgi.cgi
Affected parameters: lanDns, lanSecDns, langType

Patch Status

The source data does not mention a vendor patch, fixed firmware version or advisory. The references include only TOTOLINK's general homepage, not a security bulletin. CISA has issued no required action because the CVE is not in KEV.

If you run CA300-PoE devices on firmware 6.2c.884, check TOTOLINK directly for updated firmware. Since a public exploit exists, treat this as a priority to track.