Totolink CA750-PoE EUVD-2026-31794

Exploitation requires the attacker to hold at least low-privilege authenticated access to the Totolink CA750-PoE web administration interface, confirmed by CVSS PR:L - unauthenticated exploitation is not supported by the available vector data. The device's HTTP management interface hosting /cgi-bin/cstecgi.cgi must be reachable from the attacker's network position (CVSS AV:N). No additional platform or software prerequisites are required beyond network reachability (AT:N) and no user interaction is needed (UI:N). Factors that limit exploitation include: the mandatory low-privilege credential requirement (PR:L), meaning the attack surface narrows to scenarios where an adversary has already obtained valid credentials via default passwords, credential stuffing, or insider access; SSVC classifies the attack as not automatable, indicating per-target manual effort is required rather than mass automated exploitation; and the device must be running firmware version 6.2c.510 based on current reporting. Exploitation is further constrained to scenarios where the management interface is not isolated behind a dedicated management network.

The CVSS 4.0 base score of 2.1 is anomalously low for an OS command injection vulnerability and warrants scrutiny - it appears to be driven by the limited per-target impact ratings (VC:L/VI:L/VA:L) and the absence of subsequent system scope (SC:N/SI:N/SA:N), possibly reflecting conservative scoping of a single embedded device rather than broader infrastructure. This score understates practical risk. The EPSS score of 2.95% at the 87th percentile is a materially more informative signal: this CVE ranks higher in exploitation probability than roughly 87% of all vulnerabilities, indicating that threat actors are more likely than average to weaponize it. A publicly available POC on GitHub directly confirms that exploit code exists and is accessible to non-sophisticated attackers. SSVC assessment of Automatable: no suggests that per-target exploitation requires some manual steps (consistent with PR:L credential requirement), but Exploitation: poc and Technical Impact: partial confirm meaningful risk. The discrepancy between CVSS score (2.1, implying low priority) and EPSS percentile (87th, implying elevated real-world interest) is an explicit conflict - defenders should treat this as medium real-world risk and not deprioritize solely on the basis of the CVSS base score. No CISA KEV listing means active widespread exploitation is not confirmed at time of analysis.

An attacker who has obtained low-privilege credentials to the Totolink CA750-PoE web administration interface - whether via default credentials, credential reuse, or prior compromise - sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setUploadUserData function, embedding shell metacharacters (e.g., a semicolon-delimited command) within the FileName parameter value. The device's CGI handler passes the unsanitized filename directly to a shell command, causing the injected payload to execute with the privileges of the web server process on the embedded Linux system. A public proof-of-concept demonstrating this exact technique is available at https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_55/55.md.