Totolink CA750-PoE EUVD-2026-31752

Authentication is required: the CVSS 4.0 vector specifies PR:L (low privileges required), meaning the attacker must hold at least a low-privileged account on the device's web management interface before exploitation is possible. The vulnerable code path is specifically within the network diagnostic feature (ping and traceroute functionality) of the Setting Handler component - the attack is only reachable when this feature is accessible via the web UI. No user interaction is required beyond the attacker's own HTTP request (UI:N). Network reachability to the device's management interface on the target network is necessary (AV:N). Exploitation is limited by: the authentication prerequisite (PR:L); the SSVC assessment that the attack is not automatable, indicating manual payload construction is likely required; and the requirement that the management interface be network-accessible from the attacker's position. Environments that restrict management access to a dedicated VLAN or management network significantly reduce realistic exploitation risk beyond what the CVSS score alone conveys.

The CVSS 4.0 base score of 2.1 is anomalously low for an OS command injection with a network attack vector (AV:N) and appears to be driven by the scoring of all vulnerability impact metrics at Low (VC:L/VI:L/VA:L) and no subsequent system scope impact (SC:N/SI:N/SA:N). This scoring should be viewed skeptically - OS command injection on a network device typically grants far more than 'Low' integrity impact and may effectively represent full device compromise. The PR:L requirement (low-privilege authentication) meaningfully reduces exploitability relative to unauthenticated attacks. However, the EPSS score of 2.95% at the 87th percentile is a strong counter-signal, placing this CVE above 87% of all published vulnerabilities in terms of exploitation probability. The E:P modifier in the CVSS vector confirms the POC is factored in. SSVC rates the technical impact as partial and the attack as not automatable, suggesting exploitation requires manual steps tailored to the target - consistent with the need for authenticated access and device-specific payload crafting. The discrepancy between the very low CVSS 4.0 score and the high EPSS percentile warrants independent re-evaluation of the impact metrics, particularly for deployments where the management interface is Internet-accessible.

An attacker with low-privilege credentials to the Totolink CA750-PoE web management interface - obtained through default credentials, credential stuffing, or prior access - sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setNetworkDiag action, injecting OS command syntax (e.g., semicolons, backticks, or pipe characters) into the NetDiagHost or NetDiagTracertHop parameters. The device's firmware passes the unsanitized value directly to a shell command for ping or traceroute execution, causing the injected commands to run with the privilege level of the CGI process. A public proof-of-concept demonstrating this technique is available at https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_52/52.md.