PT-2026-139385

CVE-2026-123959

Published

2026-11-07

Updated

2026-11-07

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument langType results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Exploitability

Exploit

Fix

Impacts

Researchers

Wxhwxhwxh_Mie

Vendors

Affected products

Weakness enumeration

CWE-120: Buffer Copy without Checking Size of Input (\'Classic Buffer Overflow\')

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Related identifiers