Totolink CA750-PoE CVE-2026-9533

Authentication is required - the CVSS 4.0 vector specifies PR:L (Low Privileges Required), meaning the attacker must hold at least a low-privileged authenticated session on the device's management interface before exploitation is possible. The vulnerable functionality is specifically the firmware upgrade handler (recvUpgradeNewFw) accessible via HTTP POST/GET to /cgi-bin/cstecgi.cgi; the device's web management interface must be reachable by the attacker (AV:N indicates network reachability is assumed). No special non-default configuration is indicated as a prerequisite beyond having network access to the management interface. Exploitation is limited by the authentication requirement - unauthenticated network attackers cannot directly exploit this without first obtaining valid credentials. The management interface being exposed to untrusted networks (e.g., WAN-facing administration) significantly elevates real-world risk, as it removes the practical barrier of requiring LAN-side presence.

The CVSS 4.0 base score of 2.1 is notably low for a network-accessible OS command injection and warrants scrutiny. The vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms low-complexity, network-reachable exploitation requiring only low-level privileges - characteristics that typically yield high base scores. The anomaly stems from all impact metrics being scored Low (VC:L/VI:L/VA:L) with no downstream system impact (SC:N/SI:N/SA:N), which appears to substantially understate the realistic consequence of arbitrary OS command execution on a router device, where full persistent compromise of the device is a plausible outcome. Security teams should treat this CVSS score with skepticism and assess actual impact independently. Contrasting signals reinforce the concern: the EPSS score of 2.95% places this vulnerability at the 87th percentile, indicating significantly higher-than-average exploitation likelihood among all tracked CVEs. A public proof-of-concept exploit exists on GitHub (no public exploit identified as confirmed actively exploited per CISA KEV at time of analysis), lowering the bar for less-sophisticated actors. The combination of a publicly available PoC, a network-accessible attack vector, low exploitation complexity, and an 87th-percentile EPSS score makes this a meaningful operational priority for organizations with this device deployed, despite the misleadingly low CVSS score.

An attacker who has obtained low-privilege credentials for the Totolink CA750-PoE management interface - via default credentials, credential reuse, or prior phishing - sends a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the firmware upgrade function, embedding shell metacharacters (e.g., semicolons, backticks, or pipe characters) within the fwUrl or magicid parameter values. The router's CGI handler passes the unsanitized input directly to an OS shell call, executing attacker-controlled commands with the privileges of the web server process. A public proof-of-concept demonstrating this exact technique is available at the referenced GitHub repository, enabling replication with minimal modification.