The vulnerability is a buffer overflow within the setLanConfig function of /cgi-bin/cstecgi.cgi, triggered by carefully crafted values for lanDns, lanSecDns, and langType. This flaw is a classic stack overwrite (CWE‑119) that allows an attacker to inject malicious code and gain full compromise of the router’s operating system. The remote exploitation path means a threat actor can trigger the overflow from any network location with access to the device’s web interface, and the existence of publicly available exploit code lowers the barrier for real attacks.

TOTOLINK routers running the CA300‑PoE firmware version 6.2c.884 are affected. No other firmware revisions are documented in the current advisory.

The CVSS score of 9.4 reflects the high severity of this flaw, and while EPSS data is not provided, the vulnerability is not currently cataloged in CISA’s KEV list. Nevertheless, the publicly released exploit and remote access nature indicate a substantial risk of real‑world exploitation. Organizations with exposed CA300‑PoE devices should assess their exposure promptly.