CVE-2026-9532: Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection
A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Such manipulation of the argument FileName leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9532?
The severity of CVE-2026-9532 is medium with a score of 6.3.
How do I fix CVE-2026-9532?
To fix CVE-2026-9532, update the Totolink CA750-PoE to the latest version released by the vendor that addresses this vulnerability.
What type of vulnerability is CVE-2026-9532?
CVE-2026-9532 is categorized as an OS command injection vulnerability.
What component is affected by CVE-2026-9532?
The affected component in CVE-2026-9532 is the function setUploadUserData in the file /cgi-bin/cstecgi.cgi.
What is the potential impact of exploiting CVE-2026-9532?
Exploiting CVE-2026-9532 can lead to unauthorized execution of OS commands on the Totolink CA750-PoE device.