CVE-2026-123961

TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow

9.4 Critical

A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument KeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

What each source reports

CVE List Score used 9.4

TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow

Record: CVE-2026-123961
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C
CVSS 3.0: 9.9 CriticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C
CVSS 2.0: 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C
Weakness: CWE-120, CWE-119
Updated: 2026-11-07

EUVDEUVD-2026-119099 9.4

Record: EUVD-2026-119099
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Updated: 2026-11-07

GitHub AdvisoriesGHSA-fjhm-mr3w-93p9 8.6

A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the...

Record: GHSA-fjhm-mr3w-93p9
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-07

NVD 8.6

Record: CVE-2026-123961
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0: 9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness: CWE-119, CWE-120
Updated: 2026-11-07

Affected products

totolink ca300-poe

History

History
Recorded	Changed	Sources
Nov 7, 2026	published	EUVD
Nov 7, 2026	published	EUVD, NVD
Nov 7, 2026	aliases, references	GitHub Advisories
Nov 7, 2026	cwes, references, severity, title	CVE List
Nov 7, 2026	first indexed	EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-123961 is a critical vulnerability (CVSS 9.4) in Totolink Ca300-poe, published November 7, 2026. No source lists public exploit code. No source names a fixed version.