CVE-2026-9515: Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection
A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument plugin_version results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9515?
The severity of CVE-2026-9515 is medium with a score of 6.3.
How do I fix CVE-2026-9515?
To fix CVE-2026-9515, update the Totolink CA750-PoE to the latest firmware version that addresses this vulnerability.
What type of vulnerability is CVE-2026-9515?
CVE-2026-9515 is an OS command injection vulnerability found in the setUnloadUserData function.
Can CVE-2026-9515 be exploited remotely?
Yes, CVE-2026-9515 can be exploited remotely through manipulation of the plugin_version argument.
What component is affected by CVE-2026-9515?
CVE-2026-9515 affects the Setting Handler component in the Totolink CA750-PoE.