Totolink CA750-PoE EUVD-2026-31771

Exploitation requires a low-privilege authenticated session on the Totolink CA750-PoE web management interface - confirmed by CVSS PR:L. The attacker must be able to send HTTP requests to /cgi-bin/cstecgi.cgi, meaning the management interface must be network-reachable (AV:N). No additional prerequisites such as special configurations, specific enabled features, or elevated roles are described. What limits exploitation: the authentication requirement (PR:L) is the single gating factor - an attacker without any valid credentials cannot exploit this remotely. Default or factory credentials on unmanaged devices significantly weaken this barrier. No user interaction is required (UI:N) once authenticated. The attack is not rated as automatable (SSVC: Automatable: no), suggesting per-device authentication steps prevent trivial mass exploitation via scanning tools.

The CVSS 4.0 score of 2.1 is strikingly low for an OS command injection on a network device and warrants scrutiny. The low impact metrics (VC:L/VI:L/VA:L with no subsequent system impact SC:N/SI:N/SA:N) may reflect a sandboxed or restricted execution environment within the firmware, but this conflicts with the typical blast radius of CWE-78 on embedded Linux routers where CGI processes commonly run with elevated privileges. This discrepancy should be verified against the vendor or independent analysis before trusting the CVSS score as an accurate severity indicator. The EPSS score of 2.95% at the 87th percentile is a meaningful signal: while absolute probability is modest, this CVE ranks in exploitation likelihood above the vast majority of CVEs. CVSS AV:N/AC:L/AT:N confirms the attack is fully remote with no special conditions. PR:L indicates authenticated access is required, which is the primary limiting factor. SSVC rates Technical Impact as partial and Automatable as no, suggesting exploitation requires targeting individual devices rather than mass scanning. The existence of a public POC on GitHub (E:P in the CVSS vector) elevates urgency. Overall: real risk for any internet-exposed CA750-PoE device, constrained primarily by the low-privilege authentication requirement.

An attacker with low-privilege credentials to the Totolink CA750-PoE web interface - potentially default or weak credentials common on consumer routers - sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with a malformed plugin_version parameter containing injected shell metacharacters (e.g., semicolons, backticks, or pipes). The setUnloadUserData function processes the parameter without sanitization and passes it to an OS shell call, executing attacker-controlled commands on the device firmware. A public proof-of-concept documenting this technique is available at https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_53/53.md.