CVE-2026-123961: Critical buffer overflow in TOTOLINK CA300-PoE

CVE-2026-123961 identifies a buffer overflow vulnerability in the setWiFiBasicConfig function of /cgi-bin/cstecgi.cgi in TOTOLINK CA300-PoE version 6.2c.884. The flaw allows a remote attacker to send manipulated data in the KeyStr parameter, causing an overflow that may enable arbitrary code execution on the wireless access device. This type of flaw is particularly critical in network infrastructure devices, as it compromises control of corporate connectivity.

The vulnerability is rated CVSS 9.9 (critical). The exploit has been publicly disclosed, meaning the community can access working proof-of-concept code. The CVE was published on November 7, 2026, the same day as this report. On social media, the signal is consistent and confirms the critical rating. The absence of authentication requirements makes the attack particularly easy to execute remotely.

System administrators and IT teams must immediately verify if CA300-PoE version 6.2c.884 is present in infrastructure. Priority mitigation is to isolate the device from the public perimeter until an official patch from TOTOLINK becomes available. Implement network segmentation, active monitoring on device ports and protocols, and verify if newer versions are already available on the vendor's website. Speed is critical given the ease of remote exploitation.