SECURITYCRITICALCVE-2026-123957

CVE-2026-123957: TOTOLINK CA300-PoE setIpQosRules Buffer Overflow (CVSS 9.9)

Remotely exploitable buffer overflow in the TOTOLINK CA300-PoE 6.2c.884 setIpQosRules handler via the ipStart argument. Public exploit disclosed.

Dylan H.

Security Team

November 8, 2026
2 min read
CVE-2026-123957: TOTOLINK CA300-PoE setIpQosRules Buffer Overflow (CVSS 9.9)

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • TOTOLINK CA300-PoE firmware 6.2c.884

Executive Summary

CVE-2026-123957 is a buffer overflow in the TOTOLINK CA300-PoE (firmware 6.2c.884), published to NVD on 2026-11-07 with a listed CVSS score of 9.9. The flaw is in the setIpQosRules function of /cgi-bin/cstecgi.cgi. Manipulating the ipStart argument overflows a buffer, and the attack can be launched remotely. NVD notes that the exploit has been publicly disclosed.

AttributeValue
CVE IDCVE-2026-123957
CVSS Score9.9 (Critical)
TypeBuffer overflow
Attack VectorNetwork (remote)
Affected ProductTOTOLINK CA300-PoE 6.2c.884
ComponentsetIpQosRules in /cgi-bin/cstecgi.cgi
Published2026-11-07
SourceNVD

Technical Details

The device's web management CGI binary (cstecgi.cgi) dispatches configuration requests to handler functions. In setIpQosRules, the ipStart parameter is not safely bounds-checked before being copied into a fixed-size buffer. An oversized value corrupts adjacent memory.

On embedded networking gear, memory corruption in the management CGI typically means at minimum a crash of the web service, and potentially code execution on the device. The NVD record does not detail the specific impact beyond the buffer overflow classification, so treat code execution as possible.

Impact

  • Remote attack against the device management interface
  • A public exploit lowers the barrier for opportunistic scanning
  • A compromised access controller or PoE device can serve as a foothold on the local network

Remediation

  1. Check the vendor site for a firmware newer than 6.2c.884 and apply it. No patched version is confirmed in the NVD record at the time of writing.
  2. Remove management exposure — never expose the web interface to the internet; restrict it to a dedicated management VLAN.
  3. Restrict access with firewall rules allowing only admin hosts to reach the device.
  4. Monitor for unusual POST requests to /cgi-bin/cstecgi.cgi with abnormally long parameter values.
  5. Consider replacement if the vendor does not ship a fix; TOTOLINK devices have a history of unpatched CGI flaws.

References