CVE-2026-124059: falha crítica em TOTOLINK CA300-PoE
TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
25Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.4
A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this vulnerability is the function setWiFiWdsAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ApCliKeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Produtos afetados
TOTOLINK · CA300-PoECVEs relacionadas — TOTOLINK CA300-PoE
No mesmo produto, das mais perigosas para as menos.
CVE-2024-7217MEDIUMTOTOLINK CA300-PoE cstecgi.cgi loginauth buffer overflowEPSS 7.1%CVE-2025-6621MEDIUMTOTOLINK CA300-PoE ap.so QuickSetting os command injectionEPSS 2.5%CVE-2025-6620MEDIUMTOTOLINK CA300-PoE upgrade.so setUpgradeUboot os command injectionEPSS 2.5%CVE-2025-6619MEDIUMTOTOLINK CA300-PoE upgrade.so setUpgradeFW os command injectionEPSS 2.5%CVE-2025-6618MEDIUMTOTOLINK CA300-PoE wps.so SetWLanApcliSettings os command injectionEPSS 2.5%CVE-2026-124058CRITICALTOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflowEPSS —