Totolink CA750-PoE EUVD-2026-31789

Exploitation requires the attacker to hold at minimum low-privileged credentials on the device's web management interface - confirmed by the CVSS 4.0 PR:L metric. The vulnerable endpoint is /cgi-bin/cstecgi.cgi and the specific function targeted is setUpgradeUboot, which handles firmware upgrade operations; this endpoint must be reachable over the network (AV:N confirmed). No special non-default configuration is required beyond the web interface being accessible, as the Setting Handler is a standard component of the firmware. Exploitation is limited by: the authentication requirement (PR:L), meaning unauthenticated attackers must first obtain credentials (default credentials on consumer routers are a well-known risk factor); the device must have its management interface network-accessible; and the specific firmware version 6.2c.510 must be running. No user interaction is required once the attacker is authenticated (UI:N).

The CVSS 4.0 base score of 2.1 is strikingly low for an OS command injection finding and warrants explicit scrutiny. The vector's impact subscores - VC:L/VI:L/VA:L for the vulnerable component and SC:N/SI:N/SA:N for subsequent systems - drive this score down despite the favorable attack vector (AV:N/AC:L/AT:N/PR:L/UI:N). This low-impact scoring is incongruous with CWE-78 on an embedded Linux router, where OS command injection typically yields root-level command execution; the scoring may reflect a conservative NVD/VulDB assessment of the device's limited blast radius as a small consumer appliance rather than an enterprise asset, or may be under-assessed. Defenders should treat the CVSS score with skepticism and consider the actual technical impact independently. The EPSS score of 2.95% at the 87th percentile indicates this CVE is considered significantly more exploitable than ~87% of all CVEs tracked - this elevated ranking, combined with publicly available exploit code on GitHub (E:P in the CVSS vector), materially increases real-world exploitation risk. The absence from CISA KEV means confirmed active exploitation has not been observed by CISA at this time, but POC availability lowers the bar for opportunistic attackers. Authentication requirement (PR:L) provides some friction but is a weak barrier on consumer routers where default credentials are pervasive.

An attacker who has obtained low-privileged credentials to the Totolink CA750-PoE web interface - whether through default credential guessing, credential reuse, or prior compromise - sends a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setUpgradeUboot function with a malicious FileName value containing shell metacharacters (e.g., a semicolon followed by a command). The firmware processes this parameter without sanitization and passes it to an OS-level call, executing the injected command in the context of the CGI process. A public proof-of-concept hosted at https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_54/54.md provides a ready-made exploitation template, significantly lowering attacker skill requirements.