Is there a public PoC exploit available for EUVD-2026-31789?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31789. Prioritise patching immediately. EPSS: 2.9%.

Totolink CA750-PoE EUVD-2026-31789

Q: What is the CVSS score of EUVD-2026-31789?

EUVD-2026-31789 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.9%.

| CVE-2026-9531 LOW

OS Command Injection (CWE-78)

2026-05-26 VulDB

GHSA-x42p-x8wg-p438

Command Injection Ca750 Poe

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:40 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:07 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A weakness has been identified in Totolink CA750-PoE 6.2c.510. Impacted is the function setUpgradeUboot of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows a network-adjacent authenticated attacker to execute arbitrary operating system commands by manipulating the FileName argument passed to the setUpgradeUboot function within the /cgi-bin/cstecgi.cgi Setting Handler. Publicly available exploit code exists, hosted on GitHub, making exploitation accessible to low-skilled attackers. No public exploit identified in CISA KEV at time of analysis, though the EPSS 87th percentile ranking signals elevated exploitation interest relative to the broader CVE population despite a low absolute probability of 2.95%.

Technical ContextAI

The CA750-PoE is a PoE-capable wireless router running embedded Linux firmware version 6.2c.510, identified via CPE cpe:2.3:a:totolink:ca750-poe:*:*:*:*:*:*:*:*. The vulnerability resides in the CGI-based web management interface (/cgi-bin/cstecgi.cgi), specifically in the setUpgradeUboot function responsible for handling firmware upgrade operations. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that the FileName parameter accepted by this handler is passed unsanitized - or insufficiently sanitized - to an underlying shell execution call, allowing an attacker to inject metacharacters or shell operators that the firmware's OS interprets as commands. This class of vulnerability is common in low-cost embedded router firmware where CGI handlers call system() or popen() with user-supplied strings without adequate validation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the attack is fully network-reachable with low complexity and no required user interaction, contingent on holding low-privileged credentials.

RemediationAI

No vendor-released patch has been identified at time of analysis - no Totolink security bulletin or fixed firmware version appears in the available references. Owners of Totolink CA750-PoE devices running firmware 6.2c.510 should check https://www.totolink.net/ for firmware updates and apply any available release immediately. As a compensating control, restrict access to the device's web management interface (/cgi-bin/cstecgi.cgi) to trusted management VLANs or hosts only by applying firewall ACLs at the network perimeter - this reduces exposure to the network-accessible attack vector (AV:N) without disabling the device. Disabling remote management access entirely if not operationally required eliminates the primary attack surface; note this prevents remote administration. Changing default credentials to strong, unique passwords increases the cost of PR:L exploitation since attackers must first obtain valid credentials. Network segmentation to isolate PoE infrastructure from user-accessible subnets reduces lateral movement risk if the device is compromised. These mitigations do not eliminate the vulnerability and should be treated as temporary measures pending a vendor patch.