CVE-2026-9531: Totolink CA750-PoE RCE Vulnerability

CVE-2026-9531 Overview

CVE-2026-9531 is an operating system (OS) command injection vulnerability affecting Totolink CA750-PoE firmware version 6.2c.510. The flaw resides in the setUpgradeUboot function within /cgi-bin/cstecgi.cgi, part of the Setting Handler component. Attackers can manipulate the FileName argument to inject arbitrary OS commands. The vulnerability is exploitable remotely over the network and requires low privileges. A public exploit has been disclosed, increasing the likelihood of opportunistic abuse against exposed devices. The weakness is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Authenticated remote attackers can inject OS commands through the FileName parameter, enabling code execution on affected Totolink CA750-PoE devices.

Affected Products

Totolink CA750-PoE firmware version 6.2c.510
Component: Setting Handler (/cgi-bin/cstecgi.cgi)
Function: setUpgradeUboot

Discovery Timeline

2026-05-26 - CVE-2026-9531 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-9531

Vulnerability Analysis

The vulnerability exists in the firmware upgrade handling logic of the Totolink CA750-PoE router. The setUpgradeUboot function processes HTTP requests sent to /cgi-bin/cstecgi.cgi and accepts a FileName parameter from user input. The parameter is passed to an underlying shell command without proper sanitization or neutralization of shell metacharacters. An attacker who can reach the device's web management interface can supply crafted input containing command separators such as ;, |, or backticks, causing the embedded shell to execute attacker-controlled commands. Public exploitation details have been documented in the referenced GitHub vulnerability writeup and VulDB entry #365558.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The FileName argument flows from the HTTP request directly into a system command invocation within setUpgradeUboot, without input validation, escaping, or use of safe APIs.

Attack Vector

The attack vector is network-based and requires low-level privileges on the device, consistent with access to the authenticated management interface. No user interaction is required. The Exploit Prediction Scoring System (EPSS) value is 2.949% (86.676 percentile) as of 2026-05-28, indicating elevated exploitation likelihood compared to most CVEs.

No verified exploit code is reproduced here. Refer to the GitHub Vulnerability Documentation for technical proof-of-concept details.

Detection Methods for CVE-2026-9531

Indicators of Compromise

HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setUpgradeUboot function parameter
FileName parameter values containing shell metacharacters such as ;, |, &, `, or $()
Unexpected outbound connections originating from the router following management interface access
New or modified processes on the device that do not correspond to standard firmware behavior

Detection Strategies

Inspect web server and CGI access logs for requests targeting cstecgi.cgi with setUpgradeUboot references
Deploy network intrusion detection signatures that flag command separator characters in router CGI parameters
Monitor for anomalous administrative session activity against router management endpoints

Monitoring Recommendations

Restrict and log all access to the router's web management interface from internal networks
Forward router syslog data to a centralized log analytics platform for retention and correlation
Alert on configuration changes, firmware upgrade attempts, and authentication events on the device

How to Mitigate CVE-2026-9531

Immediate Actions Required

Remove the Totolink CA750-PoE management interface from any internet-facing exposure
Restrict administrative access to the device to trusted management VLANs or specific source IP addresses
Rotate administrative credentials on all affected devices to limit the value of any stolen low-privilege accounts
Audit recent CGI access logs for evidence of setUpgradeUboot abuse

Patch Information

At the time of publication, no vendor patch has been referenced in the available advisories. Consult the Totolink official website for firmware updates and security bulletins addressing CVE-2026-9531.

Workarounds

Disable remote management (WAN-side administration) on the router
Block external access to TCP ports used by the device's web interface at the perimeter firewall
Place the device behind a network segmentation boundary that restricts which hosts can reach /cgi-bin/cstecgi.cgi
Consider replacing the device with a supported model if no firmware update is issued by the vendor

bash

# Example: restrict management interface access using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP