CVE-2026-124057 is a remotely triggerable buffer overflow in the setWiFiMultipleConfig function of TOTOLINK CA300-PoE firmware 6.2c.884, and a public exploit is already available.
What Is It
The flaw is in the setWiFiMultipleConfig function of /cgi-bin/cstecgi.cgi on the TOTOLINK CA300-PoE. Manipulating the Key1Str1 argument causes a buffer overflow. The weakness is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input, the classic buffer overflow).
VulDB is the CNA that assigned the CVE. It was published to NVD on 2026-11-07, and its NVD analysis status is currently "Deferred."
Why It Matters
The attack can be launched remotely over the network with low attack complexity and no user interaction. VulDB scores it CVSS 3.1 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The changed scope and high confidentiality, integrity and availability impacts mean a successful attack could reach beyond the vulnerable component. VulDB also gives it CVSS 4.0 8.5 (High) and CVSS 2.0 8.3 (High).
One limiting factor: the attacker needs high privileges (PR:H), so they must already be authenticated with elevated access to the device's CGI interface.
The exploit has been released publicly and "may be used for attacks." The CVSS 4.0 data lists exploit maturity as Proof-of-Concept. This CVE is not currently in CISA's Known Exploited Vulnerabilities (KEV) catalog, so the supplied data does not confirm exploitation in the wild.
What's Vulnerable
- Vendor: TOTOLINK
- Product: CA300-PoE
- Affected version: 6.2c.884
- CPE:
cpe:2.3:o:totolink:ca300-poe_firmware:*:*:*:*:*:*:*:* - Component:
/cgi-bin/cstecgi.cgi, functionsetWiFiMultipleConfig, parameterKey1Str1
The source data lists no other versions as affected or unaffected.
Patch Status
The NVD record and its references do not say whether a vendor fix exists, and they give no remediation guidance. Because the CVE is not in KEV, there is no CISA-mandated required action or due date. Operators of CA300-PoE devices on firmware 6.2c.884 should check TOTOLINK's official site for firmware updates or advisories. Until a fix is confirmed, they should limit who has administrative access to the device's web management interface.