CVE-2026-123961 is a critical buffer overflow in the setWiFiBasicConfig function of TOTOLINK CA300-PoE firmware 6.2c.884, and a public exploit has already been disclosed.
What Is It
CVE-2026-123961 is a buffer overflow in the TOTOLINK CA300-PoE, firmware version 6.2c.884. The flaw is in the setWiFiBasicConfig function of /cgi-bin/cstecgi.cgi. An attacker triggers it by manipulating the KeyStr argument, and the attack can be launched remotely.
VulDB (the CNA) classifies the weakness as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input). The record was published on 2026-11-07, and NVD currently lists its status as "Deferred."
Why It Matters
VulDB rates this CVE 9.9 CRITICAL under CVSS v3.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H):
- Attack vector: Network
- Attack complexity: Low
- Privileges required: Low
- User interaction: None
- Scope: Changed
- Impact: High confidentiality, integrity and availability
The secondary scores are 8.6 HIGH under CVSS v4.0 and 9.0 under CVSS v2.
The CVSS v4.0 vector marks exploit maturity as Proof-of-Concept. The NVD description says the exploit "has been disclosed publicly and may be used."
There is currently no CISA KEV entry for this CVE, so CISA has not confirmed active exploitation in the wild. The sources describe the public exploit only as a proof-of-concept and do not show that it works reliably against deployed devices. Still, a public proof-of-concept and a low attack-complexity rating lower the bar for attackers. Remotely reachable network devices running this firmware are the most exposed.
What's Vulnerable
- Vendor: TOTOLINK
- Product: CA300-PoE
- Affected version: 6.2c.884
- CPE:
cpe:2.3:o:totolink:ca300-poe_firmware:*:*:*:*:*:*:*:* - Affected component:
/cgi-bin/cstecgi.cgi, functionsetWiFiBasicConfig, parameterKeyStr
Patch Status
The source material does not mention a vendor patch or fixed firmware version. There is no KEV entry, so no CISA-required action or remediation due date applies.
Operators of affected CA300-PoE devices should check the TOTOLINK vendor site for firmware updates. Until a fix is confirmed, they should limit network access to the device's management interface.