CVE-2026-9533: Totolink CA750-PoE RCE Vulnerability

CVE-2026-9533 Overview

CVE-2026-9533 is an operating system (OS) command injection vulnerability affecting the Totolink CA750-PoE router running firmware version 6.2c.510. The flaw resides in the recvUpgradeNewFw function within /cgi-bin/cstecgi.cgi, part of the device's Setting Handler component. Attackers manipulate the fwUrl or magicid arguments to inject arbitrary operating system commands. The vulnerability is exploitable remotely and requires low-privileged authentication. Public exploit details have been disclosed, increasing the likelihood of opportunistic attacks against exposed devices. The weakness is categorized under CWE-77, Improper Neutralization of Special Elements used in a Command.

Critical Impact
Remote attackers with low-privilege access can inject arbitrary OS commands through the fwUrl or magicid parameters, gaining control of the router's firmware upgrade handler.

Affected Products

Totolink CA750-PoE firmware version 6.2c.510
Component: Setting Handler (/cgi-bin/cstecgi.cgi)
Affected function: recvUpgradeNewFw

Discovery Timeline

2026-05-26 - CVE-2026-9533 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9533

Vulnerability Analysis

The vulnerability exists in the recvUpgradeNewFw function within the CGI binary located at /cgi-bin/cstecgi.cgi. This function processes firmware upgrade requests submitted to the Setting Handler component. The handler accepts the fwUrl and magicid parameters from HTTP requests without applying input neutralization before passing them to a shell command execution context. An attacker who supplies shell metacharacters such as semicolons, pipes, or backticks in either argument causes the router to execute arbitrary commands with the privileges of the CGI process. Because cstecgi.cgi typically runs with elevated rights on Totolink devices, successful injection grants control over the router's underlying operating system. The exploit has been publicly disclosed, lowering the barrier for opportunistic abuse against exposed devices.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The recvUpgradeNewFw function concatenates user-supplied fwUrl and magicid values directly into a shell command string. No allowlist validation, escaping, or parameterized execution is applied before invocation.

Attack Vector

The attack is network-based and requires low-privileged authentication to the router's management interface. The attacker sends a crafted HTTP request to /cgi-bin/cstecgi.cgi invoking recvUpgradeNewFw with shell metacharacters embedded in the fwUrl or magicid argument. The injected commands execute on the device. The EPSS score for this vulnerability is 2.949%, placing it in the 86.676 percentile of likelihood of exploitation activity.

No verified proof-of-concept code is reproduced here. Technical details are documented in the GitHub Vulnerability Document and VulDB Entry #365560.

Detection Methods for CVE-2026-9533

Indicators of Compromise

HTTP POST requests to /cgi-bin/cstecgi.cgi containing the recvUpgradeNewFw action with shell metacharacters (;, |, &, `, $()) in fwUrl or magicid parameters.
Unexpected outbound connections from the router to attacker-controlled URLs referenced in the fwUrl parameter.
Spawning of unusual child processes from the cstecgi.cgi binary on devices with logging enabled.

Detection Strategies

Inspect web server and reverse-proxy logs for requests targeting /cgi-bin/cstecgi.cgi that include recvUpgradeNewFw along with command separators in any parameter value.
Deploy network intrusion detection signatures that flag HTTP request bodies containing both the vulnerable endpoint and shell metacharacters.
Monitor egress traffic from router management VLANs for connections to unknown hosts immediately following firmware-related management requests.

Monitoring Recommendations

Forward router syslog and authentication events to a centralized logging platform for correlation with network telemetry.
Alert on any administrative HTTP traffic to Totolink CA750-PoE devices originating from outside trusted management subnets.
Track repeated firmware upgrade requests within short time windows, which may indicate exploitation attempts or brute force of the management interface.

How to Mitigate CVE-2026-9533

Immediate Actions Required

Restrict access to the router's web management interface to trusted administrative networks only. Disable WAN-side management access.
Rotate administrative credentials on all Totolink CA750-PoE devices and enforce strong, unique passwords to limit the low-privilege precondition for exploitation.
Audit recent HTTP access logs for requests to /cgi-bin/cstecgi.cgi invoking recvUpgradeNewFw and investigate any anomalous entries.

Patch Information

No vendor patch has been referenced in the published advisory at the time of writing. Monitor the Totolink Official Website for firmware updates addressing CVE-2026-9533. Until a fix is released, treat affected devices as untrusted and apply compensating controls.

Workarounds

Place the router's management interface behind a VPN or jump host so that the CGI endpoint is unreachable from untrusted networks.
Block inbound HTTP and HTTPS traffic to the router from the internet at the upstream firewall.
Where business requirements permit, replace the affected device with a supported model that receives active firmware updates.

bash

# Example: restrict router management to a trusted subnet using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP