Critical Buffer Overflow CVE-2026-124057 TOTOLINK CA300

CVE-2026-124057 describes a remote buffer overflow flaw in TOTOLINK CA300-PoE version 6.2c.884, affecting the setWiFiMultipleConfig function in the /cgi-bin/cstecgi.cgi file. Manipulation of the Key1Str1 parameter bypasses allocated memory boundaries with no input validation. Device access requires no credentials. All environments managing this specific model are affected: enterprise networks, campus infrastructure, connectivity providers.

CVSS score is 9.1 (critical). The official NVD description (published November 7, 2026) explicitly states that the exploit has been released to the public. On X, 2 posts in the last 24 hours show 5 total interactions: the signal is limited but consistent with the status of publicly available exploit. The vulnerability is confirmed, verifiable, and actively exploitable.

Immediately verify the presence of TOTOLINK CA300-PoE version 6.2c.884 devices in your inventory through network scanning or centralized management. Official fix is not yet available: urgent mitigation is to segment traffic toward these devices, isolate them from untrusted networks, and implement firewall/IDS rules on the affected ports. Apply newer firmware as soon as the vendor releases it.