Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-123957 · CRITICAL · CVSS 9.9 TOTOLINK CA300-PoE firmware version 6.2c.884 has a buffer overflow weakness in the setIpQosRules function of cstecgi.cgi, potentially allowing remote attacks via the ipStart argument. CVSS 3.0 · VulDB https://cve.new/CVE-2026-123957
🆕 New CVE TOTOLINK CA300-PoE: remote buffer overflow in setIpQosRules via cstecgi.cgi (CVE-2026-123957) A remote attacker with low-privilege login can trigger a buffer overflow through the ipStart argument. No patch listed yet https://cve.now/CVE-2026-123957?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
🚨 CVE-2026-123957 (9.9) 🚨 TOTOLINK CA300-PoE routers let an attacker with a low-privileged login crash them or run commands through a buffer overflow in their web interface. TOTOLINK CA300-PoE 6.2c.884 is affected. No fixed version is named yet. https://t.co/DOHseK31hc