PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9512 Totolink CVE debrief

A command injection vulnerability exists in the Totolink CA750-PoE 6.2c.510 firmware. The flaw resides in the setPasswordCfg function within /cgi-bin/cstecgi.cgi, where unsanitized input for the admuser and admpass parameters allows remote attackers to execute arbitrary operating system commands. The vulnerability requires authentication (PR:L per CVSS 4.0 vector), limiting its immediate exploitability. Public exploit disclosure occurred on 2026-05-25, with subsequent NVD modification on 2026-05-26. The CVSS 4.0 score of 2.1 (LOW severity) reflects the authenticated nature of the attack vector. No CISA KEV listing or known ransomware campaign use has been identified.

Vendor
Totolink
Product
CA750-PoE
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-07-23
Advisory published
2026-05-25
Advisory updated
2026-07-23

Who should care

Network administrators managing Totolink CA750-PoE access points; security teams responsible for IoT/embedded device security; organizations with remote management interfaces exposed to untrusted networks

Technical summary

The setPasswordCfg function in /cgi-bin/cstecgi.cgi fails to properly sanitize the admuser and admpass parameters, permitting OS command injection. Attackers with valid credentials can remotely execute arbitrary commands on the underlying operating system. The vulnerability affects firmware version 6.2c.510.

Defensive priority

LOW

Recommended defensive actions

  • Restrict administrative access to the management interface to trusted networks only
  • Monitor for unauthorized access attempts to /cgi-bin/cstecgi.cgi
  • Apply firmware updates from Totolink when available
  • Implement network segmentation to isolate affected devices from critical infrastructure
  • Review authentication logs for anomalous administrative activity

Evidence notes

Vulnerability confirmed via VulDB submission (ID 813923) and associated technical reference. CVSS 4.0 vector indicates network attack vector with low attack complexity, but requires prior authentication. CWE-77 and CWE-78 classifications indicate improper neutralization of special elements used in command construction.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9512 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9512

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9512 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9512

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.