Is there a public PoC exploit available for EUVD-2026-31794?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31794. Prioritise patching immediately. EPSS: 2.9%.

Totolink CA750-PoE EUVD-2026-31794

Q: What is the CVSS score of EUVD-2026-31794?

EUVD-2026-31794 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.9%.

| CVE-2026-9532 LOW

OS Command Injection (CWE-78)

2026-05-26 VulDB

GHSA-mcj4-p9r9-g5ph

Command Injection Ca750 Poe

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:19 vuln.today

Severity Changed

May 26, 2026 - 13:37 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 13:37 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Such manipulation of the argument FileName leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

AnalysisAI

OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows authenticated remote attackers to execute arbitrary shell commands by manipulating the FileName argument passed to the setUploadUserData function within the /cgi-bin/cstecgi.cgi Setting Handler. A public proof-of-concept exploit is available on GitHub, meaningfully lowering the skill barrier for adversaries. While not listed in CISA KEV, the EPSS score of 2.95% at the 87th percentile signals real-world exploitation probability well above average, making this a higher practical risk than the CVSS 4.0 base score of 2.1 alone would suggest.

Technical ContextAI

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where the application incorporates a user-supplied parameter directly into an OS-level shell command without sanitizing shell metacharacters such as semicolons, pipes, or backticks. The vulnerable component is /cgi-bin/cstecgi.cgi, a CGI-based web administration interface common in Totolink consumer and SMB networking devices. The specific function setUploadUserData handles file upload operations and passes the client-supplied FileName parameter to an underlying OS command without validation, enabling command breakout. CPE string cpe:2.3:a:totolink:ca750-poe:*:*:*:*:*:*:*:* identifies the affected platform as the Totolink CA750-PoE, a Power-over-Ethernet wireless access point. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N reflects a network-reachable, low-complexity attack requiring low-privilege credentials but no user interaction.

RemediationAI

No vendor-released patch has been identified at time of analysis - the NVD CPE entry uses a wildcard version range and no fix version appears in the VulDB advisory (https://vuldb.com/vuln/365559) or any other referenced source, so patch status is unknown rather than confirmed unavailable. As the primary compensating control, restrict access to the device's HTTP/HTTPS management interface (and any ports serving /cgi-bin/cstecgi.cgi) to trusted management VLANs or IP ranges using firewall ACLs; this directly removes network exposure of the vulnerable endpoint, though it does not eliminate risk if the attacker already has low-privilege access from within that segment. Where operationally feasible, disable remote management features entirely if the device does not require them. Monitor the Totolink vendor page at https://www.totolink.net/ and the VulDB tracking entry at https://vuldb.com/vuln/365559 for firmware updates; once a patched firmware is released, prioritize deployment given the publicly available POC. Note that network-level segmentation controls have the trade-off of potentially impacting legitimate remote administration workflows.