Is CVE-2026-9514 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9514 being exploited in the wild.

How severe is CVE-2026-9514?

Medium severity, with a CVSS score of 6.3, published 25 May 2026.

Is there a fix for CVE-2026-9514?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9514 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-9514?

Check whether you run TOTOLINK CA750-PoE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9514: TOTOLink CA750-PoE OS command injection in setNetworkDiag

CVE-2026-9514 · Severity: medium · CVSS 6.3 · Published 2026-05-25

A security vulnerability exists in the TOTOLink CA750-PoE router, a device used to provide wireless networking and Power over Ethernet connectivity. An attacker can exploit a flaw in the device's network diagnostic tools to take complete control of the router. This could allow an unauthorized person to intercept network traffic, disrupt internet connectivity, or use the device as a foothold to attack other systems on the local network.

Technologies: TOTOLINK CA750-PoE. Vendors: TOTOLINK.

Quick answers

Is CVE-2026-9514 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9514 being exploited in the wild.
How severe is CVE-2026-9514?: Medium severity, with a CVSS score of 6.3, published 25 May 2026.
Which products and versions are affected?: TOTOLINK CA750-PoE 6.2c.510.
Is there a fix for CVE-2026-9514?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9514 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-9514?: Check whether you run TOTOLINK CA750-PoE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the 'setNetworkDiag' function within the '/cgi-bin/cstecgi.cgi' component of TOTOLink CA750-PoE firmware version 6.2c.510. The vulnerability stems from improper neutralization of special elements in several parameters, including NetDiagHost, NetDiagPingNum, NetDiagPingSize, NetDiagPingTimeOut, and NetDiagTracertHop. A remote attacker with low privileges can provide crafted input (e.g., using backticks or command separators) that is directly passed to a system shell. Successful exploitation allows for arbitrary remote code execution (RCE) on the underlying operating system. A public exploit demonstrating a reverse shell via telnetd has been disclosed.

Affected products

TOTOLink CA750-PoE 6.2c.510

Timeline

2026-05-25: disclosed: Vulnerability disclosed and CVE assigned
2026-05-25: advisory: NVD published the advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.