Description

A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument langType results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-11-07T10:17:12.123Z",
  "pubdate": "2026-11-07T10:17:12.123Z",
  "executiveSummary": "A critical security vulnerability has been identified in the TOTOLINK CA300-PoE firmware version 6.2c.884, involving a buffer overflow condition within the setLanguageCfg function.\nThis vulnerability is triggered through the manipulation of the langType argument handled by the /cgi-bin/cstecgi.cgi script.\nThe flaw allows for remote exploitation, potentially enabling unauthorized actors to execute arbitrary code or cause a denial-of-service condition on the affected network device.\nGiven that proof-of-concept exploit code has been publicly disclosed, the risk of active exploitation is significant.\nThe vulnerability does not explicitly require local physical access, expanding the attack surface to any network-reachable interface.",
  "technicalDetails": "The vulnerability resides within the /cgi-bin/cstecgi.cgi binary, specifically targeting the setLanguageCfg function, which is responsible for processing language configuration requests.\nThe root cause is an improper bounds check on the input provided via the langType HTTP argument. When the application processes this parameter, it fails to perform adequate length validation before copying the user-supplied data into a fixed-size stack-based buffer.\nAn attacker can exploit this by crafting a malicious HTTP request containing an excessively long string as the langType value. This payload exceeds the allocated memory space, resulting in a buffer overflow that overwrites adjacent memory locations, including the saved return address on the stack.\nBy precisely controlling the payload, an attacker can hijack the instruction pointer, allowing for the redirection of execution flow to arbitrary code, such as shellcode injected as part of the payload or existing functions within the device's memory space (e.g., Return-Oriented Programming).\nBecause the interface /cgi-bin/cstecgi.cgi is exposed via the web management interface, the attack can be initiated remotely, provided the attacker has network access to the device's management port.\nThe exploitation process follows a sequence where the attacker identifies the web service, sends a crafted GET or POST request targeting the setLanguageCfg functionality, and triggers the memory corruption. If successfully executed, this leads to remote code execution (RCE) with the privileges of the cstecgi process, which typically runs with elevated permissions on embedded firmware.\nPost-exploitation, the attacker may gain full system control, potentially leading to unauthorized data exfiltration, modification of device settings, or complete takeover of the router/access point. Given the lack of robust memory protections (such as Address Space Layout Randomization or stack canaries) often found in such legacy firmware, the success rate for exploitation is high."
}