Description

A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument lanDns/lanSecDns/langType leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-11-07T09:17:15.177Z",
  "pubdate": "2026-11-07T09:17:15.177Z",
  "executiveSummary": "A buffer overflow vulnerability exists within the setLanConfig function of the TOTOLINK CA300-PoE, specifically within the /cgi-bin/cstecgi.cgi script. This vulnerability allows remote attackers to trigger memory corruption by manipulating specific HTTP request arguments, namely lanDns, lanSecDns, or langType.\nThe flaw stems from improper input validation during the handling of these parameters, leading to an overflow of the underlying memory buffer. Successful exploitation can result in arbitrary code execution or a denial-of-service state on the affected network device.\nGiven that the device is exposed via remote interfaces, an unauthenticated attacker can exploit this vulnerability to gain unauthorized control over the device. Because a public exploit is available, the risk of exploitation is significantly elevated. Users and administrators are urged to restrict device access and monitor for anomalous traffic patterns directed at the CGI interface.",
  "technicalDetails": "The vulnerability is localized within the binary responsible for handling CGI requests, specifically identified as /cgi-bin/cstecgi.cgi. The flaw resides in the function setLanConfig, which processes configuration parameters sent via HTTP requests. The root cause of this vulnerability is a lack of bounds checking on user-supplied input strings passed to the lanDns, lanSecDns, and langType parameters. When the application copies these arguments into a fixed-size internal buffer, it fails to verify that the length of the input does not exceed the capacity of the destination buffer.\nExploitation is achieved by sending a crafted HTTP request to the device containing an excessively long string within one of the vulnerable arguments. By exceeding the buffer's allocated size, the attacker can overwrite adjacent memory segments, including the saved return address on the stack. This manipulation allows for the redirection of the execution flow to an attacker-controlled address, facilitating the execution of arbitrary shellcode or a ROP (Return-Oriented Programming) chain.\nThe attack flow follows a predictable sequence: First, the attacker identifies a reachable instance of the TOTOLINK CA300-PoE 6.2c.884. Second, the attacker constructs a malicious HTTP POST or GET request where the targeted argument (e.g., lanDns) contains a payload exceeding the expected input threshold. Third, the cstecgi.cgi script processes the input within the setLanConfig function. Fourth, the overflow occurs, corrupting the stack frame. Finally, the hijacked instruction pointer leads the application to execute the attacker's payload.\nBecause this interface is exposed remotely, the vulnerability does not inherently require local network access, making it highly dangerous for internet-facing devices. Successful exploitation grants the attacker the same execution context as the web server process, typically resulting in full system compromise. The availability of public exploit code lowers the barrier to entry, enabling automated or scripted attacks against vulnerable deployments."
}