CVE-2026-124059 is a critical-rated (CVSS 3.1: 9.1) buffer overflow in TOTOLINK CA300-PoE firmware 6.2c.884, it can be triggered remotely, and a public exploit has been disclosed.
What Is It
The flaw is in the setWiFiWdsAddConfig function of /cgi-bin/cstecgi.cgi on the TOTOLINK CA300-PoE. Manipulating the ApCliKeyStr argument causes a buffer overflow. VulDB, the assigning CNA, classifies the weakness as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input, the "classic buffer overflow").
The CNA's description says the attack can be started remotely. The CVSS vectors also show it needs high privileges (PR:H in CVSS 3.1 and 4.0, multiple authentication in CVSS 2.0) and no user interaction.
Why It Matters
- CVSS 3.1: 9.1 CRITICAL (
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The scope is changed, with high impact to confidentiality, integrity and availability. - CVSS 4.0: 8.5 HIGH, with exploit maturity marked as Proof-of-Concept. Impact to the vulnerable system and to downstream systems is rated high.
- CVSS 2.0: 8.3 HIGH.
The CNA says the exploit "has been disclosed publicly and may be used," and a public write-up is listed in the references. CVE-2026-124059 does not currently appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so active exploitation in the wild is not confirmed by KEV. Exploitation does require high privileges. Still, the attack is network-based and low-complexity, and a public proof-of-concept exists, so exposed management interfaces are at real risk.
What's Vulnerable
- Vendor: TOTOLINK
- Product: CA300-PoE
- Affected version: 6.2c.884
- CPE:
cpe:2.3:o:totolink:ca300-poe_firmware:*:*:*:*:*:*:*:* - Component:
/cgi-bin/cstecgi.cgi, functionsetWiFiWdsAddConfig, parameterApCliKeyStr
The NVD record's status is "Deferred." It was published on 2026-11-07.
Patch Status
The supplied records don't mention a vendor patch, fixed firmware version or official advisory. Since there's no KEV entry, no CISA required action or due date applies. Owners of CA300-PoE devices running 6.2c.884 should check TOTOLINK's site for firmware updates and watch the VulDB entry for changes. They should also keep the device's web management interface off untrusted networks and restrict administrative access.