CVE-2026-123958

TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow

9.4 Critical

A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument lanDns/lanSecDns/langType leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.47%Scored on 2026-11-07. The trend appears after a second daily score.

What each source reports

CVE List Score used 9.4

TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow

Record: CVE-2026-123958
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C
CVSS 3.0: 9.9 CriticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C
CVSS 2.0: 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C
Weakness: CWE-120, CWE-119
Updated: 2026-11-07

EUVDEUVD-2026-119011 9.4

Record: EUVD-2026-119011
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Updated: 2026-11-07

GitHub AdvisoriesGHSA-c4px-fcrj-5258 8.6

A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the...

Record: GHSA-c4px-fcrj-5258
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-07

NVD 8.6

Record: CVE-2026-123958
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0: 9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness: CWE-119, CWE-120
Updated: 2026-11-07

Affected products

totolink ca300-poe

History

History
Recorded	Changed	Sources
Nov 7, 2026	published	EUVD, NVD
Nov 7, 2026	published	EUVD
Nov 7, 2026	cwes, references, severity, title	CVE List
Nov 7, 2026	aliases, products, published, references	EUVD
Nov 7, 2026	first indexed	GitHub Advisories

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-123958 is a critical vulnerability (CVSS 9.4) in Totolink Ca300-poe, published November 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. No source names a fixed version.