CVE-2026-123960: Critical buffer overflow in TOTOLINK CA300-PoE

CVE-2026-123960 is a remote buffer overflow identified in TOTOLINK CA300-PoE version 6.2c.884. The flaw resides in the setWanConfig function of the file /cgi-bin/cstecgi.cgi and is exploited through manipulation of the pppoeUser, priDns, and secDns parameters. This Power over Ethernet access point is widely deployed in enterprise and SMB environments for corporate network connectivity. Access to the vulnerable function requires no authentication and can be reached remotely, making every exposed device a direct vector for external attackers.

The CVSS score is 9.9, classified as critical. The status is confirmed: the vulnerability was published in NVD on November 7, 2026 and the authors explicitly declared that the exploit has been made public. Signals on X channels show immediate visibility (1 post in the last 24 hours, 26 interactions), with discussions consistently reporting critical severity and CVSS score 9.9. Public exploit means anyone can test the attack vector without technical barriers.

Network administrators must take action with maximum priority. First: contact TOTOLINK support to obtain a security patch and verify the versions of all CA300-PoE devices in production. Second: verify if /cgi-bin/cstecgi.cgi is reachable remotely and if parameters pppoeUser, priDns, secDns can be set without authentication. Third: assess device context: if critical and no patch is available, consider network isolation or temporary disablement until fix is available. Monitor access logs for anomalous activity.