The vulnerability resides in the TOTOLINK CA300‑PoE device version 6.2c.884. The setWiFiWdsAddConfig function in /cgi-bin/cstecgi.cgi mishandles the ApCliKeyStr argument, causing a stack‑based buffer overflow that can corrupt the stack and allow an attacker to execute arbitrary code on the router. The attack can be initiated remotely and the exploit has been publicly disclosed.

The affected product is the TOTOLINK CA300‑PoE router running firmware version 6.2c.884. No other vendors or product lines are known to share this exact code path.

The CVSS score of 9.4 indicates critical severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalogue. The remote attack vector, public disclosure, and high impact on confidentiality, integrity, and availability make exploitation highly likely if the router is exposed to the Internet or an untrusted network. A threat actor could gain full control of the device and, through it, access or manipulate the local network, exfiltrate data, or launch further attacks.