CVE-2026-124060 is a remotely exploitable buffer overflow in TOTOLINK CA300-PoE firmware 6.2c.884, with a public exploit and a CVSS 3.1 score of 9.1 (Critical).
What Is It
CVE-2026-124060 is a buffer overflow in the UploadCustomModule function of /cgi-bin/cstecgi.cgi on the TOTOLINK CA300-PoE. It is triggered by manipulating the File argument. VulDB, acting as the CNA, maps the flaw to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input, "Classic Buffer Overflow").
NVD published the record on 2026-11-07. Its NVD status is currently "Deferred."
Why It Matters
- Remote attack: The CVSS 3.1 vector is
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The attack works over the network with low complexity and needs no user interaction. - CNA scores scope as Changed: The CNA's CVSS 3.1 vector sets scope to "Changed" (
S:C), which means the CNA judges that impact could extend beyond the vulnerable component. The supplied records do not show how that would happen in practice. The vector also rates confidentiality, integrity, and availability impacts as High. - Public exploit: The NVD description says "the exploit is now public and may be used." The CVSS 4.0 vector rates exploit maturity as Proof-of-Concept (
E:P). - Limiting factor: All scoring vectors say the attacker needs high privileges (CVSS 3.1/4.0
PR:H; CVSS 2.0Au:M). That means an attacker must already be authenticated to the management interface.
Scores from the CNA:
| Version | Score | Severity |
|---|---|---|
| CVSS 3.1 (Primary) | 9.1 | Critical |
| CVSS 4.0 | 8.5 | High |
| CVSS 2.0 | 8.3 | High |
Exploitation status: CVE-2026-124060 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV therefore does not confirm active exploitation, and the supplied data contains no evidence of in-the-wild attacks.
What's Vulnerable
- Vendor: TOTOLINK
- Product: CA300-PoE
- Affected version: Firmware 6.2c.884
- CPE:
cpe:2.3:o:totolink:ca300-poe_firmware:*:*:*:*:*:*:*:* - Component:
/cgi-bin/cstecgi.cgi, functionUploadCustomModule, parameterFile
The supplied records do not say whether other firmware versions are affected.
Patch Status
The supplied NVD and KEV data contain no vendor advisory, fixed firmware version, or official remediation guidance. Because the CVE is not in KEV, there is no CISA-mandated required action or due date.
Owners of affected devices should watch TOTOLINK's site for a firmware update. Until one ships, limit who can reach the device's management interface and tightly control its administrative credentials, since exploitation requires high privileges.