AI analysis
Claude Opus · 9 Nov 2026, 10:20 CET
TOTOLINK CA300-PoE firmware buffer overflow in Wi-Fi configuration handler
TOTOLINK CA300-PoE firmware 6.2c.884 has a remotely reachable buffer overflow in its web management CGI. It requires high privileges and is rated CVSS 3.1 9.1. Restrict access to the management interface and watch for vendor updates.
In plain terms
TOTOLINK CA300-PoE is a network device managed through a built-in web interface. In firmware version 6.2c.884, the part of that interface that saves multiple Wi-Fi settings does not properly check the length of one of the values it receives. When a program writes more data into a memory area than it was built to hold, it is called a buffer overflow. The extra data can crash the device or, in some cases, let an attacker run their own code on it.
According to the scoring, an attacker would need administrative-level access to the device's management interface first. Organisations and individuals running this device, especially where the management interface is reachable from untrusted networks or uses weak or default credentials, should take note.