CVE-2026-124060

Description

A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

Affected products

References

External links from the record. They lead to third-party sites.

• VDB-432115 | TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflow technical-description, vdb-entry
  https://vuldb.com/vuln/432115
• VDB-432115 | CTI Indicators (IOB, IOC, IOA) permissions-required, signature
  https://vuldb.com/vuln/432115/cti
• CVE-2026-124060 | CVE Analysis and Report third-party-advisory
  https://vuldb.com/cve/CVE-2026-124060
• Submit #1033757 | TOTOLINK CA300-PoE CA300-PoE_Firmware V6.2c.884 Buffer Overflow third-party-advisory
  https://vuldb.com/submit/1033757
• https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-UploadCustomModule-3f953a41781f803fabf6e4b901fffb1f?source=c… exploit
• https://www.totolink.net/ product