Is there a public PoC exploit available for CVE-2026-9514?

Yes, a public proof-of-concept exploit is available for CVE-2026-9514. Prioritise patching immediately. EPSS: 2.9%.

Totolink CA750-PoE CVE-2026-9514

Q: What is the CVSS score of CVE-2026-9514?

CVE-2026-9514 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.9%.

EUVD-2026-31752 LOW

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-94gf-5wp7-whqp

Command Injection Ca750 Poe

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:22 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:07 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. Impacted is the function setNetworkDiag of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument NetDiagHost/NetDiagPingNum/NetDiagPingSize/NetDiagPingTimeOut/NetDiagTracertHop is directly passed by the attacker/so we can control the NetDiagHost/NetDiagPingNum/NetDiagPingSize/NetDiagPingTimeOut/NetDiagTracertHop leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows authenticated remote attackers to execute arbitrary operating system commands by manipulating network diagnostic parameters in the device's CGI handler. The vulnerable function setNetworkDiag, reachable at /cgi-bin/cstecgi.cgi, passes attacker-controlled values for NetDiagHost, NetDiagPingNum, NetDiagPingSize, NetDiagPingTimeOut, and NetDiagTracertHop directly into OS command execution without sanitization. A public proof-of-concept exploit exists on GitHub; the EPSS score of 2.95% at the 87th percentile indicates elevated exploitation likelihood relative to the broader CVE population, though SSVC assessment rates the attack as not automatable.

Technical ContextAI

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a classic command injection pattern prevalent in embedded network device firmware. The affected component is the CGI-based web management backend at /cgi-bin/cstecgi.cgi, which handles device configuration requests including network diagnostics such as ping and traceroute. These diagnostic features inherently invoke OS-level utilities, and the setNetworkDiag function appears to construct shell commands by directly concatenating user-supplied parameter values - a well-known antipattern in IoT firmware development. The CPE string cpe:2.3:a:totolink:ca750-poe:*:*:*:*:*:*:*:* covers the Totolink CA750-PoE, a PoE-capable wireless access point or router. Totolink devices have a documented history of similar CGI-based command injection vulnerabilities, consistent with a vendor-wide pattern of insufficient input validation in their embedded web servers.

RemediationAI

No vendor-released patch has been identified at time of analysis; no fix version was published by Totolink in any referenced advisory. As a primary compensating control, restrict access to the device's web management interface (port 80/443 and any alternate management ports) to trusted management network segments only - blocking Internet-facing exposure eliminates the remote attack surface. If remote management is not operationally required, disable it entirely in the device configuration. As a secondary control, enforce strong, non-default credentials on all management accounts to raise the effective bar for the PR:L authentication prerequisite; shared or default credentials would make the authentication requirement trivial to satisfy. Monitor VulDB advisory https://vuldb.com/vuln/365514 and the Totolink vendor site https://www.totolink.net/ for firmware updates. If a firmware update becomes available, apply it promptly given the existence of public POC exploit code. Note that disabling the network diagnostic feature (ping/traceroute) via the UI, if possible, may remove the specific vulnerable code path without full firmware replacement.