SECURITYCRITICALCVE-2026-123958

CVE-2026-123958: TOTOLINK CA300-PoE setLanConfig Buffer Overflow (CVSS 9.9)

Remotely exploitable buffer overflow in TOTOLINK CA300-PoE 6.2c.884 setLanConfig via lanDns, lanSecDns, or langType arguments. Public exploit disclosed.

Dylan H.

Security Team

November 8, 2026
2 min read
CVE-2026-123958: TOTOLINK CA300-PoE setLanConfig Buffer Overflow (CVSS 9.9)

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • TOTOLINK CA300-PoE firmware 6.2c.884

Executive Summary

CVE-2026-123958 is a second buffer overflow in the TOTOLINK CA300-PoE (firmware 6.2c.884), published to NVD on 2026-11-07 with a listed CVSS score of 9.9. It affects the setLanConfig function of /cgi-bin/cstecgi.cgi. Manipulating the lanDns, lanSecDns, or langType arguments overflows a buffer. The attack can be launched remotely and the exploit is public.

It was published alongside CVE-2026-123957, which affects the same CGI binary through a different handler, suggesting systemic missing input validation in cstecgi.cgi.

AttributeValue
CVE IDCVE-2026-123958
CVSS Score9.9 (Critical)
TypeBuffer overflow
Attack VectorNetwork (remote)
Affected ProductTOTOLINK CA300-PoE 6.2c.884
ComponentsetLanConfig in /cgi-bin/cstecgi.cgi
Published2026-11-07
SourceNVD

Technical Details

The setLanConfig handler processes LAN settings including DNS servers and the interface language. Three user-controlled arguments (lanDns, lanSecDns, langType) are copied into fixed-size buffers without adequate length checks, so an oversized value overflows the buffer.

The NVD record classifies the issue as a buffer overflow and does not detail the exact impact. On embedded devices this can mean a service crash or code execution.

Remediation

  1. Apply vendor firmware newer than 6.2c.884 when available; no fixed version is confirmed in the NVD record.
  2. Do not expose the web management interface to the internet.
  3. Isolate management access to a dedicated VLAN and allowlist admin hosts.
  4. Monitor for requests to /cgi-bin/cstecgi.cgi carrying unusually long lanDns, lanSecDns, or langType values.
  5. Plan replacement if no patch is released.

References