Executive brief
A security vulnerability exists in the Totolink CA750-PoE, a wireless access point used for providing network connectivity. An attacker can exploit this flaw to take control of the device by executing unauthorized system commands. This could lead to a complete compromise of the device, allowing an attacker to intercept network traffic or use the device as a foothold to attack other systems on the local network.
Technical details
An OS command injection vulnerability exists in the Totolink CA750-PoE firmware version 6.2c.510. The flaw is located within the 'setPasswordCfg' function in the '/cgi-bin/cstecgi.cgi' binary (specifically within the 'system.so' library). The application fails to properly sanitize the 'admuser' and 'admpass' parameters before passing them to a system shell. A remote attacker with low privileges can exploit this by sending a specially crafted POST request containing shell metacharacters (e.g., backticks) to execute arbitrary commands with the privileges of the web server. A public proof-of-concept demonstrating the ability to start a telnet backdoor has been released.
Affected products
- Totolink CA750-PoE 6.2c.510
Timeline
- 2026-05-25: disclosed: Initial vulnerability report and PoC published on GitHub
- 2026-05-25: advisory: CVE-2026-9512 published via VulDB/NVD