Is there a public PoC exploit available for EUVD-2026-31771?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31771. Prioritise patching immediately. EPSS: 2.9%.

Totolink CA750-PoE EUVD-2026-31771

Q: What is the CVSS score of EUVD-2026-31771?

EUVD-2026-31771 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.9%.

| CVE-2026-9515 LOW

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-chj8-3r5w-6fwr

Command Injection Ca750 Poe

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:19 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:07 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument plugin_version results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows a remote, low-privileged attacker to execute arbitrary operating system commands on the device by manipulating the plugin_version parameter in the setUnloadUserData function of /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit exists on GitHub, and the EPSS percentile (87th) indicates this CVE carries meaningfully higher exploitation likelihood than the majority of published vulnerabilities despite its low CVSS 4.0 base score of 2.1. No public exploit identified as actively exploited (CISA KEV), but POC availability on a network-accessible embedded device warrants prompt attention in exposed deployments.

Technical ContextAI

The Totolink CA750-PoE is a PoE-capable wireless router/access point running custom CGI-based firmware. The vulnerable component is the CGI handler /cgi-bin/cstecgi.cgi, specifically the setUnloadUserData function responsible for processing user-submitted configuration data, including a plugin_version argument. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that user-supplied input is passed directly to a shell execution context - likely a call to system(), popen(), or equivalent - without adequate sanitization or argument escaping. The CPE string cpe:2.3:a:totolink:ca750-poe:*:*:*:*:*:*:*:* covers all sub-versions, though the confirmed affected version per EUVD-2026-31771 is specifically 6.2c.510. This class of vulnerability is common in consumer and SMB-grade embedded networking firmware where input validation is often absent in CGI parameter handling.

RemediationAI

No vendor-released patch with a confirmed fix version has been identified at time of analysis. The Totolink vendor page (https://www.totolink.net/) should be monitored for firmware updates addressing CVE-2026-9515 or EUVD-2026-31771. As an immediate compensating control, restrict access to the device management interface (/cgi-bin/cstecgi.cgi) to trusted internal networks only by placing the device behind a firewall that blocks port 80/443 from untrusted sources - this eliminates remote exploitation while preserving local management. Additionally, disable remote management features if not operationally required. If administrative access must remain network-accessible, enforce network segmentation (VLAN isolation) to limit which hosts can reach the management plane. Note that these controls do not eliminate the vulnerability but reduce the attack surface to authenticated users already on the management network. Replacing affected devices with actively maintained alternatives should be evaluated given the absence of a confirmed patch.