CVE-2026-9532: Totolink CA750-PoE RCE Vulnerability

CVE-2026-9532 Overview

CVE-2026-9532 is an operating system command injection vulnerability affecting the Totolink CA750-PoE router running firmware version 6.2c.510. The flaw resides in the setUploadUserData function within /cgi-bin/cstecgi.cgi, part of the device's Setting Handler component. Attackers can manipulate the FileName argument to inject arbitrary operating system commands. The vulnerability is exploitable over the network and the exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed devices. The weakness is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command).

Critical Impact
Authenticated remote attackers can inject operating system commands through the FileName parameter, leading to arbitrary command execution on the router.

Affected Products

Totolink CA750-PoE firmware 6.2c.510
Component: Setting Handler (/cgi-bin/cstecgi.cgi)
Affected function: setUploadUserData

Discovery Timeline

2026-05-26 - CVE-2026-9532 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9532

Vulnerability Analysis

The vulnerability exists in the setUploadUserData handler exposed through the CGI endpoint /cgi-bin/cstecgi.cgi. The handler accepts a FileName argument from client requests and passes the value into an operating system command without proper neutralization of shell metacharacters. Because the argument is incorporated into a command interpreter context, attackers can append shell separators such as ;, |, or backticks to execute arbitrary commands alongside the intended operation. The publicly available proof of concept lowers the barrier for exploitation against any reachable device running the affected firmware.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The setUploadUserData function trusts the FileName parameter as a benign string and does not apply input filtering, allowlisting, or safe API alternatives such as execve with a fixed argument array. The CGI binary executes the resulting command string through a shell, which interprets injected metacharacters and runs attacker-supplied payloads with the privileges of the web server process.

Attack Vector

The attack is performed over the network against the router's HTTP management interface. According to the CVSS 4.0 vector, the attacker requires low privileges and no user interaction. An authenticated session against the management UI is sufficient to issue a crafted request to /cgi-bin/cstecgi.cgi invoking setUploadUserData with a malicious FileName value containing shell metacharacters. Successful exploitation results in command execution within the router's operating environment, enabling persistence, traffic interception, or pivoting into adjacent network segments. Detailed reproduction steps are documented in the GitHub vulnerability writeup and the VulDB entry #365559.

Detection Methods for CVE-2026-9532

Indicators of Compromise

HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setUploadUserData topicurl parameter combined with shell metacharacters (;, |, &, backticks, $()) in the FileName field.
Unexpected outbound connections originating from the router to attacker-controlled infrastructure following management interface activity.
New or modified files in writable router paths, or unexpected processes spawned by the CGI handler.

Detection Strategies

Inspect web access logs on the device or upstream proxies for request bodies referencing setUploadUserData with non-alphanumeric characters in the FileName argument.
Deploy network intrusion detection signatures that flag cstecgi.cgi requests containing common command-injection payloads against Totolink user-agents and management ports.
Correlate management-plane authentication events with subsequent anomalous CGI requests to identify abuse of low-privilege credentials.

Monitoring Recommendations

Restrict and log all administrative access to the router's HTTP interface, alerting on access from non-management subnets.
Monitor router DNS and egress traffic for connections to uncategorized or newly registered domains following configuration changes.
Forward router syslog data to a centralized analytics platform to retain forensic evidence of CGI requests and shell activity.

How to Mitigate CVE-2026-9532

Immediate Actions Required

Remove the Totolink CA750-PoE management interface from any WAN-facing exposure and restrict access to a dedicated management VLAN.
Rotate all administrative credentials used on the device and disable any unused accounts that could be abused given the low-privilege exploitation requirement.
Audit recent CGI request logs and device configuration for signs of unauthorized commands or persistence.

Patch Information

No vendor patch has been referenced in the published advisory at the time of NVD publication. Administrators should monitor the Totolink official website for firmware updates superseding version 6.2c.510 and apply them as soon as they become available.

Workarounds

Place the router behind an upstream firewall and block inbound HTTP/HTTPS connections to the management interface from untrusted networks.
Enforce strong, unique administrative passwords and disable remote management until a fixed firmware is released.
If the device is end-of-life or no patch is forthcoming, plan replacement with a supported model that receives security updates.

bash

# Example upstream firewall rule to block external access to the router management interface
# Replace ROUTER_IP and MGMT_SUBNET with environment-specific values
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 80 ! -s MGMT_SUBNET -j DROP
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 443 ! -s MGMT_SUBNET -j DROP