CVE-2026-9511

Deferred Deferred - Pending Action

Command Injection in Totolink CA750-PoE

Publication date: 2026-05-25

Last updated on: 2026-05-28

Assigner: VulDB

Description

A vulnerability was identified in Totolink CA750-PoE 6.2c.510. This affects the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Such manipulation of the argument webWlanIdx leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-25

Last Modified

2026-05-28

Generated

2026-07-06

AI Q&A

2026-05-26

EPSS Evaluated

2026-07-04

NVD

CVE-2026-9511

EUVD

EUVD-2026-31760

Affected Vendors & Products

Vendor	Product	Version / Range
totolink	ca750-poe	6.2c.510

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Totolink CA750-PoE device, specifically in the function setWebWlanIdx within the /cgi-bin/cstecgi.cgi file of the Setting Handler component.

The issue arises from improper handling of the argument webWlanIdx, which allows an attacker to perform OS command injection.

This means an attacker can remotely execute arbitrary operating system commands on the affected device.

The exploit for this vulnerability is publicly available, increasing the risk of exploitation.

Impact Analysis

An attacker exploiting this vulnerability can remotely execute arbitrary OS commands on the affected Totolink CA750-PoE device.

This could lead to unauthorized control over the device, potentially allowing the attacker to disrupt network operations, access sensitive information, or use the device as a foothold for further attacks.

Hi! I’m here to help you understand CVE-2026-9511. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70