CVE-2024-7217mediumCWE-120

CVE-2024-7217: medium-severity vulnerability in TOTOLINK CA300-PoE

TOTOLINK CA300-PoE cstecgi.cgi loginauth buffer overflow

Published · Updated

Follow this CVE+ Monitor CA300-PoE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 7.1%
A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. This vulnerability affects the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272788. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
TOTOLINK · CA300-PoE
Related CVEs — TOTOLINK CA300-PoE

In the same product, most dangerous first.

CVE-2025-6621MEDIUMTOTOLINK CA300-PoE ap.so QuickSetting os command injectionEPSS 2.5%CVE-2025-6620MEDIUMTOTOLINK CA300-PoE upgrade.so setUpgradeUboot os command injectionEPSS 2.5%CVE-2025-6619MEDIUMTOTOLINK CA300-PoE upgrade.so setUpgradeFW os command injectionEPSS 2.5%CVE-2025-6618MEDIUMTOTOLINK CA300-PoE wps.so SetWLanApcliSettings os command injectionEPSS 2.5%CVE-2026-124059CRITICALTOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflowEPSS —CVE-2026-124058CRITICALTOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflowEPSS —