Is there a public PoC exploit available for CVE-2026-9513?

Yes, a public proof-of-concept exploit is available for CVE-2026-9513. Prioritise patching immediately. EPSS: 2.9%.

Totolink CA750-PoE CVE-2026-9513

Q: What is the CVSS score of CVE-2026-9513?

CVE-2026-9513 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.9%.

EUVD-2026-31768 LOW

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-cj6j-82gg-5fpg

Command Injection Ca750 Poe

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:18 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:07 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A weakness has been identified in Totolink CA750-PoE 6.2c.510. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Executing a manipulation of the argument host_time can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows a low-privileged remote attacker to execute arbitrary system commands on the device by manipulating the host_time argument passed to the NTPSyncWithHost function within the CGI-based Setting Handler. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation. Despite being an OS command injection - a class of vulnerability typically associated with high-severity scores - the vendor CVSS 4.0 score of 2.1 reflects unusually low impact ratings (VC:L/VI:L/VA:L) that security teams should independently verify, as the 87th-percentile EPSS score signals that this CVE's characteristics are consistent with real-world exploitation interest.

Technical ContextAI

The affected component is the CGI-based web management interface of the Totolink CA750-PoE PoE router/switch, specifically the NTPSyncWithHost function located in /cgi-bin/cstecgi.cgi. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) is the root cause - the firmware passes user-supplied input from the host_time parameter directly to a shell command or system() call without adequate sanitization or escaping. This is a classic CGI command injection pattern common in embedded firmware, where input intended to specify an NTP host is not validated, allowing shell metacharacters (e.g., semicolons, pipes, backticks) to break out of the intended command context and execute attacker-controlled instructions. The CPE cpe:2.3:a:totolink:ca750-poe:*:*:*:*:*:*:*:* (wildcard version) confirms the finding is scoped to Totolink's CA750-PoE product line at the specific firmware version 6.2c.510 per EUVD-2026-31768.

RemediationAI

No vendor-released patch has been identified at time of analysis - the Totolink website reference in this CVE does not point to a specific advisory or patched firmware. As an immediate compensating control, restrict access to the device's web management interface (the CGI endpoint /cgi-bin/cstecgi.cgi) to trusted management VLANs or hosts only, using upstream firewall ACLs or the device's own access control settings if available; this does not eliminate the vulnerability but removes network reachability (AV:N), which is required for exploitation. Disable remote management access over untrusted networks entirely if not operationally required. Monitor VulDB advisory https://vuldb.com/vuln/365513 and the Totolink site https://www.totolink.net/ for firmware updates. Given that the PoC is publicly available, treat this as an active risk and prioritize network-level isolation until a vendor patch is released. Do not expose the device's management interface to the public internet.