CVE-2026-124058 is a remotely triggerable buffer overflow in the TOTOLINK CA300-PoE firmware 6.2c.884, and a public exploit has been released.
What Is It
The flaw is in the setWiFiRepeaterConfig function of /cgi-bin/cstecgi.cgi on the TOTOLINK CA300-PoE. Manipulating the ApCliKeyStr argument can cause a buffer overflow. The weakness is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input, the classic buffer overflow). VulDB reported it as the CNA, and NVD published it on 2026-11-07. Its current NVD status is "Deferred."
Why It Matters
VulDB rates the issue CVSS 3.1 9.1 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The CVSS 4.0 score is 8.5 (High) and the CVSS 2.0 score is 8.3 (High). The attack works over the network with low complexity and no user interaction. It requires high privileges, which limits exposure to some degree. The scope is marked "changed," with high impact to confidentiality, integrity, and availability.
According to the CVE description, the exploit has been made public and could be used for attacks. The CVSS 4.0 data lists exploit maturity as Proof of Concept. CISA KEV does not list this CVE, so the supplied sources do not confirm active exploitation.
What's Vulnerable
- Vendor: TOTOLINK
- Product: CA300-PoE
- Affected version: 6.2c.884
- CPE:
cpe:2.3:o:totolink:ca300-poe_firmware:*:*:*:*:*:*:*:*
The supplied records list no other affected versions.
Patch Status
The supplied NVD and KEV data do not mention a vendor patch or fixed firmware version. Because the CVE is not in KEV, CISA has issued no required action or remediation deadline. Owners of CA300-PoE units running 6.2c.884 should check TOTOLINK's site for updated firmware. Until a fix is confirmed, they should limit who can reach the device's management interface and tightly control administrative credentials, since exploitation requires high privileges.