CVE-2026-9515: Totolink CA750-PoE RCE Vulnerability

CVE-2026-9515 Overview

CVE-2026-9515 is an operating system command injection vulnerability affecting the Totolink CA750-PoE router running firmware version 6.2c.510. The flaw resides in the setUnloadUserData function within /cgi-bin/cstecgi.cgi, part of the device's Setting Handler component. Attackers manipulate the plugin_version argument to inject arbitrary OS commands. The issue is remotely reachable over the network and a public exploit is available. The weakness is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on the router by tampering with the plugin_version parameter, leading to device compromise.

Affected Products

Totolink CA750-PoE firmware version 6.2c.510
Component: Setting Handler in /cgi-bin/cstecgi.cgi
Function: setUnloadUserData

Discovery Timeline

2026-05-26 - CVE-2026-9515 published to the National Vulnerability Database (NVD)
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9515

Vulnerability Analysis

The vulnerability exists in the setUnloadUserData handler exposed through the Common Gateway Interface (CGI) endpoint /cgi-bin/cstecgi.cgi. The handler accepts a plugin_version parameter and passes its value into a system-level command execution path without proper neutralization of shell metacharacters. An attacker who can reach the web management interface and supply this parameter triggers execution of attacker-controlled commands in the context of the CGI process, which typically runs with elevated privileges on embedded routers. Public proof-of-concept material is referenced in the GitHub vulnerability documentation and the VulDB entry #365515.

Root Cause

The root cause is missing input validation and sanitization on the plugin_version argument before it is incorporated into a system command. Characters such as ;, |, &, and backticks pass through unfiltered, allowing command chaining and substitution. This pattern is common in embedded router firmware where CGI handlers concatenate untrusted input into system() or shell invocations.

Attack Vector

The attack vector is network-based. An attacker submits a crafted HTTP request to /cgi-bin/cstecgi.cgi invoking the setUnloadUserData function with a malicious plugin_version payload. The Common Vulnerability Scoring System (CVSS) 4.0 vector indicates low privileges are required and no user interaction is needed. Successful exploitation yields command execution on the underlying Linux-based firmware, enabling persistence, traffic interception, or pivoting into adjacent network segments. See the VulDB CTI record for additional exploit context.

No verified exploit code is reproduced here. Refer to the public proof-of-concept for technical reproduction details.

Detection Methods for CVE-2026-9515

Indicators of Compromise

HTTP POST requests to /cgi-bin/cstecgi.cgi containing topicurl=setUnloadUserData with shell metacharacters (;, |, &, $()) inside the plugin_version field.
Unexpected child processes spawned by the cstecgi.cgi binary, especially shells such as /bin/sh or download utilities like wget, tftp, or curl.
Outbound connections from the router to unfamiliar hosts shortly after administrative HTTP traffic.

Detection Strategies

Inspect web server and CGI access logs for requests targeting setUnloadUserData and flag any non-printable or shell-metacharacter content in plugin_version.
Deploy network intrusion detection signatures that match POST bodies referencing setUnloadUserData combined with command separators.
Baseline normal management traffic from administrative subnets and alert on management requests sourced from unexpected IP addresses.

Monitoring Recommendations

Forward router syslog and CGI access logs to a centralized SIEM for correlation with firewall and DNS telemetry.
Monitor for new cron entries, modified /etc files, or unexpected listening ports on the router consistent with post-exploitation activity.
Track firmware version inventory to identify Totolink CA750-PoE devices still running 6.2c.510.

How to Mitigate CVE-2026-9515

Immediate Actions Required

Restrict access to the router's web management interface to trusted administrative networks only, blocking exposure to the internet.
Rotate administrative credentials, since exploitation requires low-privileged authentication.
Audit the device for signs of compromise, including unfamiliar processes, modified configuration files, and unexpected outbound connections.

Patch Information

No vendor patch is referenced in the published advisory at the time of NVD publication. Consult the Totolink official website for firmware updates addressing CVE-2026-9515 and apply them as soon as they become available.

Workarounds

Disable remote administration on the WAN interface and require management traffic to traverse a VPN.
Place the affected device behind a firewall that filters requests to /cgi-bin/cstecgi.cgi from untrusted sources.
Segment the router from sensitive internal assets to limit lateral movement if the device is compromised.
Replace the device with a supported model if the vendor does not issue a fix within an acceptable timeframe.

bash

# Example: block external access to the router's management CGI at an upstream firewall
iptables -A FORWARD -p tcp -d <router-ip> --dport 80 \
  -m string --algo bm --string "/cgi-bin/cstecgi.cgi" \
  -m iprange ! --src-range <trusted-admin-range> -j DROP