A remotely triggerable buffer overflow in the setLanguageCfg function of TOTOLINK CA300-PoE firmware 6.2c.884 has a public exploit and a CVSS 3.1 score of 9.1 (Critical).
What Is It
CVE-2026-123959 is a buffer overflow in TOTOLINK CA300-PoE firmware version 6.2c.884. It sits in the setLanguageCfg function of /cgi-bin/cstecgi.cgi. An attacker triggers it by manipulating the langType argument. The weakness is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
VulDB (the CNA) published the CVE on 2026-11-07. Its NVD status is currently "Deferred."
Why It Matters
- Remote attack: The flaw can be exploited over the network with low attack complexity and no user interaction.
- Public exploit: The CNA says the exploit "has been released to the public and may be used for attacks." The CVSS 4.0 vector rates exploit maturity as Proof-of-Concept.
- Severe impact: The CVSS 3.1 vector (
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as High, with a Changed scope. The CVSS 4.0 score is 8.5 (High), with High impact on both the vulnerable and subsequent systems. - Limiting factor: All scoring vectors require high privileges (CVSS 3.1/4.0
PR:H; CVSS 2.0Au:M). An attacker would most likely need authenticated administrative access first.
KEV status: This CVE is not in the CISA Known Exploited Vulnerabilities catalog. A public exploit exists, but CISA has not confirmed active exploitation in the wild.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| TOTOLINK | CA300-PoE | 6.2c.884 |
CPE: cpe:2.3:o:totolink:ca300-poe_firmware:*:*:*:*:*:*:*:*
Vulnerable component: /cgi-bin/cstecgi.cgi, function setLanguageCfg, parameter langType.
Patch Status
The source records contain no fixed firmware version, vendor advisory or patch. Since there is no KEV entry, there is also no CISA-mandated required action or due date. Until TOTOLINK releases a fix:
- Check the vendor site for firmware updates.
- Restrict network access to the device's management interface.
- Limit who has administrative credentials, since exploitation requires high privileges.