A stack-based buffer overflow exists in the setWiFiMultipleConfig function of the cstecgi.cgi CGI program in code‑projects for Plugin 4.1.2cu.5137. By supplying an overly long wepkey2 argument, an attacker can overwrite adjacent memory, potentially enabling arbitrary code execution on the affected device. The CVE does not specify the privileged context of the vulnerable code, so the exact scope of compromise is not explicitly defined, but the exploit can be triggered remotely without authentication.

Each deployment of code‑projects for Plugin that includes version 4.1.2cu.5137 is impacted, as the vulnerability resides in both the /cgi-bin/cstecgi.cgi script and its underlying /lib/cste_modules/wireless.so library.

The CVSS score of 8.7 indicates high severity, and the public exploit demonstrates that attackers can trigger the overflow by sending a crafted request to the wepkey2 parameter over HTTP. No EPSS score is available, but the public exploit indicates a non‑negligible threat. The vulnerability has not been catalogued in CISA KEV; the remote nature of the attack and the lack of required authentication mean that exploitation probability is significant. Mitigation requires the vendor patch or containment measures.