CVE-2026-9534

low · 2.1

A flaw has been found in Totolink CA750-PoE 6.2c.510. This affects the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Executing a manipulation of the argument PIN can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

2.1

CVSS

10.8%

EPSS (exploit prob.)

96th

EPSS percentile

2026-05-26

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-77CWE-78

References

https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_57/57.md
https://vuldb.com/submit/813938
https://vuldb.com/vuln/365561
https://vuldb.com/vuln/365561/cti
https://www.totolink.net/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-9534