Description

A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-11-07T09:17:14.890Z",
  "pubdate": "2026-11-07T09:17:14.890Z",
  "executiveSummary": "The TOTOLINK CA300-PoE (version 6.2c.884) is susceptible to a buffer overflow vulnerability within the setIpQosRules function located in /cgi-bin/cstecgi.cgi.\nThis flaw allows a remote, unauthenticated attacker to inject malicious data into the ipStart argument, potentially leading to arbitrary code execution, system instability, or complete device compromise.\nThe vulnerability stems from improper input validation when processing user-supplied data, failing to enforce boundary checks on the affected argument.\nGiven that the device is a network infrastructure component, this vulnerability poses a critical risk to the confidentiality, integrity, and availability of the local network segment. Exploitation can be executed remotely, significantly lowering the barrier for entry for potential adversaries.\nSuccessful exploitation could allow an attacker to gain full administrative control over the affected device, potentially facilitating further attacks within the internal network, intercepting traffic, or permanently bricking the device through malicious firmware manipulation.",
  "technicalDetails": "The vulnerability is localized within the setIpQosRules function, which is a component of the cstecgi.cgi binary responsible for handling Quality of Service (QoS) rule configurations.\nThe root cause is a classic stack-based buffer overflow resulting from an unsafe copy operation where the length of the input data is not validated against the destination buffer size. Specifically, the ipStart argument is processed by the CGI interface without adequate bounds checking before being written into fixed-length memory buffers.\nTo trigger the vulnerability, an attacker sends a crafted HTTP request to the /cgi-bin/cstecgi.cgi endpoint, specifying the setIpQosRules function and supplying a maliciously formed ipStart parameter. By providing a payload that exceeds the capacity of the destination buffer, the attacker can overwrite adjacent memory segments on the process stack.\nThe exploitation flow involves identifying the offset required to reach the return address of the function on the stack. By precisely crafting the payload, the attacker can redirect the instruction pointer (EIP/RIP) to execute arbitrary code or shellcode injected within the payload itself. Given the architecture of common embedded devices, this often leads to control over the device’s execution flow.\nThe attack is remotely exploitable, requiring no prior authentication. The cstecgi.cgi binary typically operates with high privileges within the embedded OS environment, meaning the resulting impact of code execution often grants the attacker root access to the underlying system.\nPost-exploitation, the attacker may bypass security mechanisms, persist within the system, or pivot into the internal network. The lack of stack canaries or address space layout randomization (ASLR) in many firmware versions of this class of device makes this type of buffer overflow highly reliable for attackers to weaponize. Once the overflow occurs, the application process may crash, leading to a Denial of Service (DoS) condition, or continue executing injected instructions."
}