Dashboard / CVE-2026-123957

CVE-2026-123957

HIGH
MEDIUM Priority: 0.04 BB Relevance: 67/100
Published: 2026-11-07 Modified: 2026-11-09 First seen: 2026-11-07 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Weakness Classification (2)

Affected Software (2)

VendorProductVersion
TOTOLINK CA300-PoE 6.2c.884
TOTOLINK CA300-PoE 6.2c.884

References & Advisories (6)

https://vuldb.com/vuln/432020
vdb-entry technical-description
https://vuldb.com/submit/1033672
third-party-advisory
https://vuldb.com/vuln/432020/cti
signature permissions-required

Bug Bounty Relevance

67 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.6 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.47%
Raw Score 0.004660
Percentile 40.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00466
2026-11-12
0.00466
2026-11-10
0.00466
2026-11-09
0.00466
2026-11-08
0.00466
2026-11-07
0.00466

Intelligence Sources

mitre ref →
nvd ref →

External Links