CVE-2026-9534: Totolink CA750-PoE RCE Vulnerability

CVE-2026-9534 Overview

CVE-2026-9534 is an operating system command injection vulnerability in the Totolink CA750-PoE router running firmware version 6.2c.510. The flaw exists in the setWiFiWpsConfig function within /cgi-bin/cstecgi.cgi, part of the device's Setting Handler component. Attackers can manipulate the PIN argument to inject arbitrary operating system commands. The issue is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The exploit has been published, making opportunistic targeting plausible despite the requirement for low-privileged authentication.

Critical Impact
Authenticated remote attackers can execute arbitrary OS commands on affected Totolink CA750-PoE devices through the WPS PIN parameter, with public exploit code available.

Affected Products

Totolink CA750-PoE firmware 6.2c.510
Setting Handler component within /cgi-bin/cstecgi.cgi
setWiFiWpsConfig function handling WPS configuration

Discovery Timeline

2026-05-26 - CVE-2026-9534 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9534

Vulnerability Analysis

The vulnerability resides in the setWiFiWpsConfig handler exposed through the CGI endpoint /cgi-bin/cstecgi.cgi. This handler processes WPS (Wi-Fi Protected Setup) configuration requests submitted by authenticated users. The PIN parameter, intended to carry numeric WPS pairing codes, is passed to an underlying shell command without proper sanitization. An attacker who controls this input can break out of the intended command context and append arbitrary shell instructions. Because the CGI binary typically runs with elevated privileges on embedded routers, injected commands inherit broad system access. The flaw is reachable over the network and requires only low-privileged credentials, making lateral compromise from a guest account feasible.

Root Cause

The root cause is improper neutralization of special elements in the PIN argument before it is concatenated into a system command string. Per CWE-77, the function fails to validate, escape, or whitelist input characters such as ;, |, &, and backticks. The handler trusts the request payload after authentication, omitting defensive parsing for command metacharacters in WPS PIN handling.

Attack Vector

An authenticated attacker sends a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setWiFiWpsConfig topicurl. The PIN parameter contains shell metacharacters followed by attacker-chosen commands. The CGI process executes the injected payload in the device's shell context, enabling command execution, persistence, or pivoting into the internal network. Public proof-of-concept material is referenced in the GitHub vulnerability documentation and VulDB entry #365561.

No verified exploit code is reproduced here. Refer to the published references for technical reproduction details.

Detection Methods for CVE-2026-9534

Indicators of Compromise

HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setWiFiWpsConfig topicurl with shell metacharacters such as ;, |, &, $(, or backticks in the PIN field.
Unexpected outbound connections originating from the router to attacker-controlled infrastructure shortly after WPS configuration requests.
New or modified processes spawned by the cstecgi.cgi parent on the device, observable through router logs or syslog forwarding.

Detection Strategies

Inspect HTTP traffic destined for the router management interface for anomalous PIN values that contain non-numeric characters.
Deploy network IDS signatures that flag requests to cstecgi.cgi carrying setWiFiWpsConfig plus shell metacharacters.
Correlate authentication events on the router with subsequent configuration changes to identify abuse of low-privileged accounts.

Monitoring Recommendations

Forward router syslog data to a centralized logging platform and alert on commands executed by web service processes.
Monitor DNS and outbound traffic from the router's management VLAN for connections to unknown hosts.
Track firmware version reporting across the fleet to ensure all CA750-PoE devices are inventoried for patch status.

How to Mitigate CVE-2026-9534

Immediate Actions Required

Restrict access to the router's web management interface to trusted administrative networks only and block exposure to the internet.
Rotate all router credentials and remove unused low-privileged accounts that could be leveraged to reach the vulnerable endpoint.
Disable WPS functionality if the deployment does not require it, reducing exposure of the setWiFiWpsConfig handler.

Patch Information

At the time of publication, no vendor advisory or firmware patch has been linked in the NVD record for CVE-2026-9534. Consult the Totolink official website for firmware updates addressing the CA750-PoE 6.2c.510 release. Track the VulDB entry for updates on remediation status.

Workarounds

Place affected devices behind a network segment that blocks untrusted clients from reaching TCP ports used for HTTP/HTTPS management.
Enforce strong, unique administrative passwords to limit the population of accounts that meet the low-privilege precondition.
Replace the device with a supported model if vendor patches remain unavailable for an extended period.

bash

# Example: restrict router management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP