Is there a public PoC exploit available for CVE-2026-9511?

Yes, a public proof-of-concept exploit is available for CVE-2026-9511. Prioritise patching immediately. EPSS: 2.3%.

Totolink CA750-PoE CVE-2026-9511

Q: What is the CVSS score of CVE-2026-9511?

CVE-2026-9511 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.3%.

EUVD-2026-31760 LOW

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-wv96-774q-mh29

Command Injection Ca750 Poe

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:39 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:07 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was identified in Totolink CA750-PoE 6.2c.510. This affects the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Such manipulation of the argument webWlanIdx leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the webWlanIdx argument within the setWebWlanIdx function of /cgi-bin/cstecgi.cgi. A publicly available proof-of-concept exploit hosted on GitHub exists, materially lowering the skill threshold for exploitation despite the low CVSS 4.0 score of 2.1. No public exploit identified at time of analysis as confirmed actively exploited (CISA KEV), but EPSS places this at the 85th percentile, signaling elevated exploitation likelihood relative to the broader CVE population.

Technical ContextAI

The vulnerability resides in the setWebWlanIdx function within the CGI-based web interface handler /cgi-bin/cstecgi.cgi of Totolink CA750-PoE firmware version 6.2c.510 - a Power over Ethernet SOHO router/access point running embedded Linux with a CGI web management interface. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that the webWlanIdx argument, which controls wireless LAN index selection, is passed to an OS-level shell command without adequate sanitization or metacharacter escaping. The CPE string cpe:2.3:a:totolink:ca750-poe:*:*:*:*:*:*:*:* identifies this as a Totolink application-layer product with a wildcard version field, meaning NVD has not constrained a fixed version boundary beyond what the EUVD entry specifies. CGI-based configuration handlers in embedded network devices are a well-documented class of injection targets because they frequently concatenate user-supplied parameters directly into system() or popen() calls.

RemediationAI

No vendor-released patch has been identified in the available data - no fix version or Totolink security advisory was found among the provided references, so patch availability is unconfirmed at time of analysis. Administrators should immediately restrict access to the CA750-PoE web management interface (/cgi-bin/cstecgi.cgi) from untrusted networks using perimeter firewall ACLs or router rules; this eliminates the AV:N network vector but does not remediate the underlying flaw. Ensure device credentials are changed from factory defaults and enforce strong unique passwords, as the PR:L prerequisite means valid credentials are required - raising this barrier is the most direct risk reducer available without a patch. Network segmentation placing the device on a dedicated management VLAN inaccessible from general user or internet-facing segments further limits the attack surface. Monitor VulDB at https://vuldb.com/vuln/365511 and the Totolink vendor site at https://www.totolink.net/ for firmware updates. The GitHub PoC at https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_49/49.md details the attack mechanics and can be used to develop detection signatures for IDS/IPS rules targeting crafted webWlanIdx parameter values.