TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow

Summary

A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Remediation

1. Inventory every TOTOLINK CA300-PoE deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://vuldb.com/cve/CVE-2026-123957
• Advisoryhttps://vuldb.com/submit/1033672
• Referencehttps://vuldb.com/vuln/432020
• Referencehttps://vuldb.com/vuln/432020/cti
• Referencehttps://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setIpQosRules-3f953a41781f801195e5e07dfe7488b9?source=copy_link
• Referencehttps://www.totolink.net/