Is there a public PoC exploit available for CVE-2026-9512?

Yes, a public proof-of-concept exploit is available for CVE-2026-9512. Prioritise patching immediately. EPSS: 2.9%.

Totolink CA750-PoE CVE-2026-9512

Q: What is the CVSS score of CVE-2026-9512?

CVE-2026-9512 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.9%.

EUVD-2026-31762 LOW

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-28vj-4cr8-q6x4

Command Injection Ca750 Poe

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:22 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:07 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security flaw has been discovered in Totolink CA750-PoE 6.2c.510. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Performing a manipulation of the argument admuser/admpass results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows a network-reachable, low-privilege authenticated attacker to execute arbitrary operating system commands by injecting shell metacharacters into the admuser or admpass arguments of the setPasswordCfg function within /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit has been published on GitHub, materially lowering the bar for exploitation. No vendor-released patch has been identified at time of analysis, leaving affected deployments dependent on compensating controls.

Technical ContextAI

The Totolink CA750-PoE is a Power-over-Ethernet networking device whose web management interface is served via CGI at /cgi-bin/cstecgi.cgi. The setPasswordCfg function within this handler processes administrative credential updates - specifically the admuser (admin username) and admpass (admin password) parameters - without adequate sanitization before passing them to an underlying OS-level command. This is a classic CWE-78 (Improper Neutralization of Special Elements Used in an OS Command) flaw: user-supplied input containing shell metacharacters (e.g., semicolons, backticks, pipes) is interpreted by the shell, enabling arbitrary command execution in the context of the CGI process. CPE cpe:2.3:a:totolink:ca750-poe:*:*:*:*:*:*:*:* covers this product family, and the confirmed affected firmware is 6.2c.510 per ENISA EUVD-2026-31762.

RemediationAI

No vendor-released patch has been identified at time of analysis; monitor the Totolink vendor site (https://www.totolink.net/) and VulDB (https://vuldb.com/vuln/365512) for patch availability. As the primary compensating control, place the device's management interface on a dedicated, isolated management VLAN and enforce firewall rules blocking external and untrusted network access to the HTTP management port - this directly counters the AV:N attack vector but does not eliminate risk from internal or management-segment threat actors. If remote management is not operationally required, disable it entirely via the device configuration. Because the vulnerable function handles credential changes, ensure that all administrative accounts use strong, unique passwords to reduce the value of any credential-based lateral movement. Consider device replacement if Totolink does not release a patch within an operationally acceptable window, given that a public POC is actively available.