CVE-2026-9532: Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection
A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Such manipulation of the argument FileName leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Prevent remote invocation of /cgi-bin/cstecgi.cgi (the setUploadUserData entrypoint). Block or restrict access to this endpoint via device configuration, webserver rules, or a WAF so the FileName argument cannot be supplied remotely.
Totolink CA750-PoE web interface (/cgi-bin/cstecgi.cgi) access = restricted - Configuration
Disable remote/wan administration of the device (deny management access from untrusted networks) to mitigate remote exploitation.
Totolink CA750-PoE web management remote_administration = disabled - Compensating control
At the network perimeter, block or limit access to the device's management ports (HTTP/HTTPS) and/or place the device in a management-only VLAN. Restrict management access to a small set of trusted IP addresses or use a jump host/VPN for administration.
- Operational
Monitor device and edge logs for requests to /cgi-bin/cstecgi.cgi and signs of exploitation; isolate and take offline any device showing suspicious activity. Apply vendor-supplied firmware updates or patches as soon as they are released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9532?
The severity of CVE-2026-9532 is medium with a score of 6.3.
How do I fix CVE-2026-9532?
To fix CVE-2026-9532, update the Totolink CA750-PoE to the latest version released by the vendor that addresses this vulnerability.
What type of vulnerability is CVE-2026-9532?
CVE-2026-9532 is categorized as an OS command injection vulnerability.
What component is affected by CVE-2026-9532?
The affected component in CVE-2026-9532 is the function setUploadUserData in the file /cgi-bin/cstecgi.cgi.
What is the potential impact of exploiting CVE-2026-9532?
Exploiting CVE-2026-9532 can lead to unauthorized execution of OS commands on the Totolink CA750-PoE device.