CVE-2026-123957

Name of the Vulnerable Software and Affected Versions TOTOLINK CA300-PoE version 6.2c.884

Description A buffer overflow exists in the web interface of the device. A remote attacker with low-privileged login credentials can trigger this issue by manipulating the ipStart argument within the setIpQosRules() function of the '/cgi-bin/cstecgi.cgi' endpoint. This can lead to a system crash or remote command execution.

Recommendations As a temporary workaround, restrict access to the '/cgi-bin/cstecgi.cgi' endpoint or avoid using the ipStart argument within the setIpQosRules() function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.