{"id":"EM-20261107-GB3B","url":"https://cyber.eventmonitor.net/incident/EM-20261107-GB3B/totolink-ca300-poe-vulnerability-cve-2026-124058/","type":"cve","title":"TOTOLINK CA300-PoE Vulnerability (CVE-2026-124058)","subtitle":"CVE-2026-124058","subject":"CVE-2026-124058","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-07T21:31:14.000Z","firstSignal":"2026-11-07T19:17:28.263Z","lastSignal":"2026-11-07T21:31:14.000Z","updated":"2026-11-07T22:19:49.894Z","revision":1,"life":[{"status":"Born","at":"2026-11-07T21:31:14.000Z","why":"second independent source: C29 CIRCL Vulnerability-Lookup"},{"status":"Developing","at":"2026-11-07T21:31:14.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-07T19:17:28.263Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-07T21:31:14.000Z","what":"Born: second source, C29 CIRCL Vulnerability-Lookup. Page EM-20261107-GB3B created."}],"stages":[{"name":"Disclosed","at":"2026-11-07T19:17:28.263Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-07T19:17:28.263Z","detail":"CVSS 8.5"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-07T19:17:28.263Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-124058 (CVSS 8.5)","text":"A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124058"},{"at":"2026-11-07T21:31:14.000Z","source":"C29","sourceName":"CIRCL Vulnerability-Lookup","role":"Database","severity":2,"title":"GHSA-wr9v-cwjw-49x5 / CVE-2026-124058","text":"A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available…","url":"https://vulnerability.circl.lu/vuln/GHSA-wr9v-cwjw-49x5"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-07T19:17:28.263","score":8.5,"severity":"HIGH","desc":"A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available…","product":"","seen":1794089989894},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}