CVE-2026-123958: Critical Buffer Overflow in TOTOLINK CA300-PoE

CVE-2026-123958 identifies a remote buffer overflow in the setLanConfig function of /cgi-bin/cstecgi.cgi in TOTOLINK CA300-PoE version 6.2c.884. The vulnerability can be triggered through unauthenticated manipulation of the lanDns, lanSecDns, and langType parameters. A remote attacker can exploit this flaw to achieve arbitrary code execution on the device, compromising routers and PoE access points deployed in enterprise and critical infrastructure environments.

The vulnerability carries a CVSS score of 9.9 (critical) and was published on November 7, 2026. According to the official NVD description, a public exploit is already available. Recent social media signals on X report consistent findings: the vulnerability is part of a cluster of critical TOTOLINK CVEs, and to date, no official patch has been released by the vendor.

For defenders: immediately inventory TOTOLINK CA300-PoE devices in critical environments. If present, consider temporary network isolation or restriction of CGI access. Monitor access to /cgi-bin/cstecgi.cgi for suspicious parameters. Contact TOTOLINK support for patch availability information. If the vendor fails to provide remediation within reasonable timeframes, evaluate replacement with a non-vulnerable alternative.