Totolink CA750-PoE EUVD-2026-31762

Exploitation requires the attacker to be authenticated to the Totolink CA750-PoE web management interface with at least low-level privileges (confirmed by CVSS PR:L - unauthenticated exploitation is not indicated by available data). The /cgi-bin/cstecgi.cgi endpoint must be reachable over the network from the attacker's position (CVSS AV:N). The specific attack surface is the setPasswordCfg function - the administrative credential-change feature must be accessible at the attacker's privilege tier. Limiting factors: credential acquisition is a prerequisite; SSVC marks the attack as not automatable, indicating per-target, manual exploitation rather than worm-style propagation; impact is scoped to the vulnerable component with no confirmed lateral scope (SC:N). Defenders with management interfaces isolated from untrusted networks and with non-default, strong credentials face substantially reduced realistic risk.

The CVSS 4.0 base score of 2.1 (Low) reflects conservative impact metrics (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N) that appear inconsistent with an OS command injection on an embedded networking device, where such vulnerabilities typically yield full root shell access - defenders should not rely on this score alone. The EPSS score of 2.95% at the 87th percentile is a stronger prioritization signal: this CVE ranks above 87% of all CVEs in predicted near-term exploitation probability, driven in part by the confirmed public POC. SSVC designates exploitation as 'poc,' technical impact as 'partial,' and automatable as 'no,' suggesting targeted manual exploitation rather than mass scanning. There is no CISA KEV listing, so confirmed active exploitation in the wild is not established. The CVSS 4.0 vector confirms PR:L (low privileges required), meaning unauthenticated mass exploitation is not the primary threat model - the attacker must have at least a low-privilege credential. For IoT/network device deployments where management interfaces are internet-exposed or accessible from untrusted segments, the combination of public POC, no patch, and EPSS 87th-percentile warrants elevated priority despite the low base score.

An attacker who has obtained a low-privilege account on the CA750-PoE management interface - through credential guessing, default credentials, or prior compromise - sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking setPasswordCfg, with shell metacharacters embedded in the admuser or admpass field (e.g., admpass=password;id). The device firmware processes the input without sanitization, and the injected command executes in the context of the web server process. A public proof-of-concept demonstrating this technique is available at https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_50/50.md.