SECURITYCRITICALCVE-2026-124060

CVE-2026-124060: TOTOLINK CA300-PoE Buffer Overflow With Public Exploit

A critical buffer overflow in TOTOLINK CA300-PoE 6.2c.884 UploadCustomModule can be triggered remotely, and a public exploit exists. No vendor patch reported.

Dylan H.

Security Team

November 8, 2026
2 min read
CVE-2026-124060: TOTOLINK CA300-PoE Buffer Overflow With Public Exploit

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • TOTOLINK CA300-PoE firmware 6.2c.884

CVE-2026-124060: TOTOLINK CA300-PoE Buffer Overflow

A critical memory-corruption flaw, CVE-2026-124060, was published on November 7, 2026 for the TOTOLINK CA300-PoE access point running firmware 6.2c.884. The bug sits in the UploadCustomModule function of /cgi-bin/cstecgi.cgi, where the File argument is copied into a fixed buffer without a length check. The advisory says the attack can be launched remotely and that an exploit is already public.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-124060
ProductTOTOLINK CA300-PoE
Affected firmware6.2c.884
Component/cgi-bin/cstecgi.cgi, function UploadCustomModule
WeaknessBuffer overflow (CWE-119 / CWE-120)
CVSS v3.19.1 (Critical)
CVSS v4.09.4 (reported by VulDB)
Attack vectorNetwork (remote)
Public exploitYes
CISA KEVNot listed at time of writing
Assigned byVulDB

Authentication caveat: the CVSS 3.1 vector reported by VulDB lists high privileges required, while some secondary write-ups describe the flaw as pre-authentication. Treat the device as exposed either way until the vendor clarifies.

Related Flaws

Two sibling CVEs in the same device, CVE-2026-124058 (in setWiFiRepeaterConfig) and CVE-2026-124059, are also buffer overflows. The same cstecgi.cgi handler has been a repeat source of bugs across the TOTOLINK product line, so expect more findings.

Patch Status

As of publication, no official fixed firmware had been reported by the vendor. Check the TOTOLINK download page for updated CA300-PoE firmware before relying on any mitigation.

Recommended Actions

  1. Remove management access from untrusted networks. Never expose the web interface to the internet.
  2. Segment these access points onto a dedicated management VLAN.
  3. Restrict access to the admin interface by source IP where the firmware allows it.
  4. Monitor for unusual POST requests to /cgi-bin/cstecgi.cgi, especially large File parameters.
  5. Replace the device with a supported product if the vendor does not ship a fix.

References