Critical 9.1

A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function...

CVE-2026-124058 First seen on SecPulse Nov 8, 03:15

Original description The description as published by the source.

A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Critical 9.1; CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4: High 8.5; CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Published: Nov 8, 2026
First seen on SecPulse: Nov 8, 03:15
GHSA: GHSA-wr9v-cwjw-49x5
CWE: CWE-119

NVD GitHub Advisory

Tags(click for explanation)

CWE

CWE-120 CWE-119

All

Totolink Ca300 Poe

Detection sources

NIST National Vulnerability DatabaseNov 8, 04:17
GitHub Security Advisories (Global)Nov 8, 06:31
CVE.org (CVE Program・cvelistV5)Nov 8, 03:15