CVE-2026-9534
BaseFortify
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | ca750-poe | 6.2c.510 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-9534 is a Remote Command Execution (RCE) vulnerability found in the Totolink CA750-PoE router, specifically in the setWiFiWpsConfig function of the /cgi-bin/cstecgi.cgi component. The flaw arises because the PIN parameter is taken from user input without proper validation or sanitization, allowing an attacker to inject arbitrary operating system commands.
An attacker can exploit this vulnerability remotely by sending a specially crafted HTTP POST request to the vulnerable endpoint, which can result in executing malicious commands on the router, such as launching a shell. This is due to the lack of input sanitization in the parameter extraction process.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the vulnerability CVE-2026-9534 affects compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected Totolink router. This can lead to full compromise of the device, including unauthorized access, control over network traffic, and potential use of the router as a foothold for further attacks within the network.
Exploitation can result in loss of confidentiality, integrity, and availability of the network managed by the router, as attackers may manipulate device settings, intercept or redirect traffic, or disrupt network services.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted HTTP POST request to the vulnerable endpoint /cgi-bin/cstecgi.cgi targeting the setWiFiWpsConfig function with a manipulated PIN parameter.
A typical detection command involves using curl or similar tools to send a POST request with a PIN value containing a command injection payload.
- Example command to test for vulnerability: curl -X POST http://<router-ip>/cgi-bin/cstecgi.cgi -d 'action=setWiFiWpsConfig&PIN=;telnetd -l /bin/sh -p 8896;'
If the router executes the injected command, it indicates the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint /cgi-bin/cstecgi.cgi by limiting network exposure, such as blocking external access to the router's management interface.
Additionally, disable WPS functionality if possible, as the vulnerability is related to the setWiFiWpsConfig function.
Monitor network traffic for suspicious POST requests targeting the vulnerable endpoint and consider applying any available firmware updates from the vendor that address this issue.