CVE-2026-9511: Totolink CA750-PoE RCE Vulnerability

CVE-2026-9511 Overview

CVE-2026-9511 is an operating system (OS) command injection vulnerability affecting the Totolink CA750-PoE router running firmware version 6.2c.510. The flaw resides in the setWebWlanIdx function within /cgi-bin/cstecgi.cgi, part of the device's Setting Handler component. Attackers can manipulate the webWlanIdx argument to inject arbitrary operating system commands. The attack is exploitable remotely over the network, and a public exploit is available. The weakness is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact

Authenticated remote attackers can inject OS commands via the webWlanIdx parameter, with a public proof-of-concept already published.

Affected Products

• Totolink CA750-PoE firmware version 6.2c.510
• Component: Setting Handler (/cgi-bin/cstecgi.cgi)
• Vulnerable function: setWebWlanIdx

Discovery Timeline

• 2026-05-25 - CVE-2026-9511 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-9511

Vulnerability Analysis

The vulnerability exists in the setWebWlanIdx handler exposed through the Common Gateway Interface (CGI) endpoint /cgi-bin/cstecgi.cgi on the Totolink CA750-PoE router. The handler accepts a webWlanIdx argument and passes it into an OS-level command without sufficient sanitization. As a result, shell metacharacters supplied by an attacker are interpreted by the underlying command interpreter rather than treated as data.

The EPSS score is 2.27% with a percentile of 84.89, indicating a higher-than-average exploitation probability relative to other published CVEs. A public exploit referenced through VulDB entry #365511 and a corresponding GitHub vulnerability report increases the risk of opportunistic exploitation against exposed devices.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The setWebWlanIdx function constructs a command string that incorporates the attacker-controlled webWlanIdx value without escaping shell separators such as ;, &&, |, or backticks. The router executes the resulting command with the privileges of the web server process, which on most embedded Totolink devices is root.

Attack Vector

An attacker reaches the vulnerable endpoint over the network by sending a crafted HTTP request to /cgi-bin/cstecgi.cgi with the setWebWlanIdx action and a malicious webWlanIdx payload. Exploitation requires low privileges and no user interaction. Successful exploitation yields arbitrary command execution on the device, enabling configuration tampering, credential theft, traffic interception, or pivoting deeper into the network.

// No verified exploit code is reproduced here.
// Refer to the public report for technical details:
// https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_49/49.md

Detection Methods for CVE-2026-9511

Indicators of Compromise

• HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setWebWlanIdx action with shell metacharacters (;, |, &, backticks) in the webWlanIdx field.
• Unexpected outbound connections originating from the router to attacker infrastructure shortly after CGI requests.
• New or modified files in writable router paths such as /tmp or /var immediately following CGI activity.

Detection Strategies

• Inspect web and proxy logs in front of management interfaces for requests targeting cstecgi.cgi with suspicious webWlanIdx values.
• Apply intrusion detection signatures matching command-injection patterns in HTTP request bodies destined for Totolink CGI endpoints.
• Correlate router authentication events with subsequent CGI parameter manipulation to identify abuse from low-privileged accounts.

Monitoring Recommendations

• Forward router syslog and HTTP access logs to a centralized analytics platform for retention and review.
• Alert on any external exposure of the Totolink web management interface on TCP/80 or TCP/443.
• Baseline normal CGI parameter values and flag deviations containing shell operators or encoded command sequences.

How to Mitigate CVE-2026-9511

Immediate Actions Required

• Remove the Totolink CA750-PoE management interface from any internet-facing network segment.
• Restrict administrative access to the router web UI to a dedicated management VLAN with strict access control lists.
• Rotate all router administrative credentials and review configured user accounts for unauthorized additions.
• Inspect the device for signs of compromise, including modified firmware, cron entries, or persistent processes.

Patch Information

At the time of NVD publication, no vendor patch is referenced in the advisory. Monitor the Totolink official website and the VulDB entry #365511 for firmware updates addressing the setWebWlanIdx handler. Apply firmware updates as soon as the vendor releases a fixed version for 6.2c.510.

Workarounds

• Disable remote management on the WAN interface and restrict LAN-side access to the web UI to trusted hosts.
• Place the device behind a network firewall that filters HTTP requests containing shell metacharacters targeting cstecgi.cgi.
• If feasible, replace affected devices with supported hardware until a vendor patch is released.

# Example firewall rule to block external access to the router web UI
iptables -A INPUT -i wan0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i wan0 -p tcp --dport 443 -j DROP