CVE-2026-9534

2.1 lowEPSS 10%

Low (2.1). EPSS 10% chance of exploitation in the next 30 days.

A flaw has been found in Totolink CA750-PoE 6.2c.510. This affects the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Executing a manipulation of the argument PIN can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 10% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-78
Published: 2026-05-26
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

References

https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_57/57.md
https://vuldb.com/submit/813938
https://vuldb.com/vuln/365561
https://vuldb.com/vuln/365561/cti
https://www.totolink.net/

Check your stack JSON