Is there a public PoC exploit available for EUVD-2026-31796?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31796. Prioritise patching immediately. EPSS: 2.9%.

Totolink CA750-PoE EUVD-2026-31796

Q: What is the CVSS score of EUVD-2026-31796?

EUVD-2026-31796 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.9%.

| CVE-2026-9534 LOW

OS Command Injection (CWE-78)

2026-05-26 VulDB

GHSA-2wm4-fmvg-pxj4

Command Injection Ca750 Poe

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:02 vuln.today

Severity Changed

May 26, 2026 - 13:37 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 13:37 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A flaw has been found in Totolink CA750-PoE 6.2c.510. This affects the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Executing a manipulation of the argument PIN can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

AnalysisAI

OS command injection in Totolink CA750-PoE 6.2c.510 allows a low-privileged remote attacker to execute arbitrary operating system commands by manipulating the PIN argument passed to the setWiFiWpsConfig function within /cgi-bin/cstecgi.cgi. The attack requires no user interaction and is reachable over the network, making it a credible threat to any deployment exposing the device's management interface. A public proof-of-concept exploit has been published on GitHub, and EPSS places this at the 87th percentile of exploitation likelihood despite a low raw CVSS 4.0 score of 2.1 - a signal worth noting against the mismatch.

Technical ContextAI

The Totolink CA750-PoE is a Power-over-Ethernet wireless access point running firmware version 6.2c.510, identified via CPE cpe:2.3:a:totolink:ca750-poe:*:*:*:*:*:*:*:*. The vulnerable code path resides in the CGI-based web management backend at /cgi-bin/cstecgi.cgi, specifically in the setWiFiWpsConfig handler responsible for configuring Wi-Fi Protected Setup (WPS). CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that the PIN parameter supplied by the user is concatenated directly - or with insufficient sanitization - into a shell command string, which the firmware then executes in the context of the device OS. This class of flaw is endemic to embedded device firmware where input is piped through system() calls or similar shell invocation APIs without escaping. The attack vector (AV:N) confirms the vulnerable endpoint is network-accessible, while PR:L indicates the attacker must hold at minimum a low-privileged authenticated session on the device management interface.

RemediationAI

No vendor-released patch has been identified at time of analysis - no fixed firmware version appears in any referenced source, including VulDB (https://vuldb.com/vuln/365561) or the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-9534). Until Totolink releases a patched firmware, organizations should apply the following specific compensating controls: restrict or disable remote access to the device's web management interface (/cgi-bin/cstecgi.cgi) via firewall ACL or management VLAN isolation, reducing the network-accessible attack surface; disable WPS on the device if the feature is not operationally required, which removes the vulnerable setWiFiWpsConfig code path from reachability; enforce strict authentication controls and rotate any shared management credentials to limit who holds the low-privilege session required to trigger the vulnerability. Monitor Totolink's official site (https://www.totolink.net/) and the VulDB advisory for firmware updates. Note that disabling WPS may impact provisioning workflows for wireless clients using PIN-based enrollment.