Totolink CA750-PoE CVE-2026-9534

The attack requires the attacker to hold a valid low-privilege authenticated session on the Totolink CA750-PoE web management interface (confirmed by PR:L in the CVSS 4.0 vector). The vulnerable function setWiFiWpsConfig is part of the WPS configuration workflow, meaning the WPS feature must be present and the endpoint reachable - both conditions are met by default in firmware 6.2c.510. No additional technical requirements (AT:N) or user interaction (UI:N) are needed beyond authentication. Exploitation is limited by: (1) the requirement for at least low-privilege credentials, ruling out fully unauthenticated exploitation; (2) the SSVC 'Automatable: no' assessment, consistent with the credential dependency preventing trivial mass scanning; and (3) the device being a PoE access point, meaning the management interface is typically only accessible on the local or management network rather than the open internet - though misconfigured deployments with WAN-exposed management interfaces face elevated risk.

The risk picture here is internally inconsistent and warrants careful interpretation. The CVSS 4.0 base score of 2.1 is anomalously low for a remote OS command injection, driven entirely by the impact sub-scores being rated Low across confidentiality, integrity, and availability on the vulnerable component (VC:L/VI:L/VA:L) with no subsequent system impact (SC:N/SI:N/SA:N) - a scoring posture that likely reflects the limited attack surface of an embedded AP rather than a true ceiling on attacker capability. In practice, OS command injection on embedded firmware frequently yields full root access. Contrast this with the EPSS 87th percentile ranking: despite a 2.95% raw probability, this CVE scores higher than 87% of all CVEs, reflecting the public POC (E:P in the vector), network accessibility, and low complexity. SSVC assesses exploitation status as PoC, technical impact as partial, and automatable as 'no' - the latter plausibly because authentication is required (PR:L). KEV status is not confirmed, meaning active exploitation is not confirmed by CISA at time of analysis. No patch data is present in any referenced source. The combination of public exploit code, network accessibility, low-privilege requirement, and no available patch makes this a meaningful operational risk for organizations running this specific device, regardless of the headline CVSS score.

An attacker who has obtained low-privilege credentials to the Totolink CA750-PoE management interface - whether through credential stuffing against a default password, prior phishing, or internal network access - sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with the setWiFiWpsConfig action and a maliciously constructed PIN value containing shell metacharacters (e.g., semicolons, backticks, or pipe characters). The firmware passes the unsanitized PIN to an OS command without escaping, executing the attacker's payload in the device's shell context. A public proof-of-concept demonstrating this technique is available at https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_57/57.md.