PT-2026-139402

CVE-2026-123960

Published

2026-11-07

Updated

2026-11-07

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument pppoeUser/priDns/secDns can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

Exploitability

Exploit

Fix

Impacts

Researchers

Wxhwxhwxh_Mie

Vendors

Affected products

Weakness enumeration

CWE-120: Buffer Copy without Checking Size of Input (\'Classic Buffer Overflow\')

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Related identifiers