Totolink CA750-PoE CVE-2026-9511

The web management interface endpoint /cgi-bin/cstecgi.cgi must be reachable from the attacker's network position - either via local LAN access or, if the management interface is exposed to the internet (common with misconfigured SOHO devices), remotely over the public internet. Per the CVSS vector PR:L, the attacker must hold a valid low-privilege authenticated session on the device; unauthenticated exploitation is not confirmed by available data. The vulnerable injection point is the webWlanIdx parameter within the WLAN index configuration handler, meaning the wireless LAN setting feature must be accessible within the attacker's session context. Exploitation is NOT constrained by attack complexity (AC:L), special timing or race conditions (AT:N), or user interaction (UI:N). The two primary limiting factors are: (1) valid device credentials must be obtained or guessed - factory-default credentials on SOHO devices frequently satisfy this requirement trivially - and (2) the management interface must be network-reachable from the attacker's position.

The CVSS 4.0 score of 2.1 is anomalously low for a remotely exploitable OS command injection with a public PoC - this disparity warrants explicit scrutiny. The vector AV:N/AC:L/AT:N/PR:L/UI:N indicates network-accessible, low-complexity exploitation requiring only low-privilege credentials and no user interaction, which is an aggressive attack profile. However, the impact sub-scores (VC:L/VI:L/VA:L) are all set to Low, drastically suppressing the final score - this appears inconsistent with OS command injection on a network device, which typically confers full device compromise. CVSS indicates the scope is confined to the vulnerable system with no lateral impact (SC:N/SI:N/SA:N), but this should be verified against the actual device privilege model. EPSS at 2.27% (85th percentile) signals meaningfully elevated real-world exploitation interest. The E:P modifier in the CVSS vector and the GitHub PoC reference confirm exploit code is available, not merely theoretical. No CISA KEV listing was found, so active mass exploitation is not confirmed. Real-world risk for internet-exposed devices - common for SOHO gear - is moderate to significant, especially given that SOHO routers frequently retain factory-default credentials, which satisfies the PR:L prerequisite trivially.

An attacker who has obtained low-privilege credentials to the CA750-PoE web management interface - either through credential stuffing against default credentials or prior reconnaissance - sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with a webWlanIdx parameter containing shell metacharacters such as semicolons, backticks, or pipe characters. The setWebWlanIdx handler processes the input without sanitization and passes it directly into an OS-level command, executing the attacker's injected payload with the privileges of the CGI web server process. A public PoC documenting this exact technique is available on GitHub, meaning exploitation requires minimal attacker skill.