EUVD Vulnerability Catalog
EUVD-2026-119324
Severity: CRITICAL
Base Score: 9.4
CVSS Version: 4.0
Vulnerability Description
A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument Key1Str1 results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
▪
Attack Vector (AV): Network
▪
Attack Complexity (AC): Low
▪
Attack Requirements (AT): None
▪
Privileges Required (PR): High
▪
User Interaction (UI): None
▪
Vulnerability Confidentiality Impact (VC): High
▪
Vulnerability Integrity Impact (VI): High
▪
Vulnerability Availability Impact (VA): High
▪
Subsequent Confidentiality Impact (SC): High
▪
Subsequent Integrity Impact (SI): High
▪
Subsequent Availability Impact (SA): High
▪
E: P
Affected Vendors & Systems
Vendor
Totolink
References & Advisory Links
- https://vuldb.com/vuln/432112
- https://vuldb.com/vuln/432112/cti
- https://vuldb.com/cve/CVE-2026-124057
- https://vuldb.com/submit/1033754
- https://lavender-bicycle-a5a.notion.site/TOTOLINK-CA300-PoE-setWiFiMultipleConfig-3f953a41781f800fab65eaa6a2887fa1?source=copy_link
- https://www.totolink.net/
- https://nvd.nist.gov/vuln/detail/CVE-2026-124057
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
VulDB
EPSS Probability
0
Known Aliases
CVE-2026-124057
GHSA-5w7f-7pm8-j5vg
Published On
2026-11-07
Last Updated
2026-11-07