# CVE-2026-9514: TOTOLink CA750-PoE OS command injection in setNetworkDiag

Source: https://junglewise.ai/threats/cve-2026-9514-totolink-ca750-poe-os-command-injection-in-setnetworkdiag  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-9514 · Severity: medium · CVSS 6.3 · Published 2026-05-25

A security vulnerability exists in the TOTOLink CA750-PoE router, a device used to provide wireless networking and Power over Ethernet connectivity. An attacker can exploit a flaw in the device's network diagnostic tools to take complete control of the router. This could allow an unauthorized person to intercept network traffic, disrupt internet connectivity, or use the device as a foothold to attack other systems on the local network.

Technologies: [TOTOLINK CA750-PoE](https://junglewise.ai/threats/technologies/ca750-poe). Vendors: [TOTOLINK](https://junglewise.ai/threats/vendors/totolink).

## Quick answers

**Is CVE-2026-9514 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9514 being exploited in the wild.

**How severe is CVE-2026-9514?** Medium severity, with a CVSS score of 6.3, published 25 May 2026.

**Which products and versions are affected?** TOTOLINK CA750-PoE 6.2c.510.

**Is there a fix for CVE-2026-9514?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9514 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-9514?** Check whether you run TOTOLINK CA750-PoE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in the 'setNetworkDiag' function within the '/cgi-bin/cstecgi.cgi' component of TOTOLink CA750-PoE firmware version 6.2c.510. The vulnerability stems from improper neutralization of special elements in several parameters, including NetDiagHost, NetDiagPingNum, NetDiagPingSize, NetDiagPingTimeOut, and NetDiagTracertHop. A remote attacker with low privileges can provide crafted input (e.g., using backticks or command separators) that is directly passed to a system shell. Successful exploitation allows for arbitrary remote code execution (RCE) on the underlying operating system. A public exploit demonstrating a reverse shell via telnetd has been disclosed.

## Affected products

- TOTOLink CA750-PoE 6.2c.510

## Timeline

- 2026-05-25: disclosed: Vulnerability disclosed and CVE assigned
- 2026-05-25: advisory: NVD published the advisory

## References

- [https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_52/52.md](https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_52/52.md)
- [https://vuldb.com/submit/813926](https://vuldb.com/submit/813926)
- [https://vuldb.com/vuln/365514](https://vuldb.com/vuln/365514)
- [https://vuldb.com/vuln/365514/cti](https://vuldb.com/vuln/365514/cti)
- [https://www.totolink.net/](https://www.totolink.net/)

## Related threats

- [Totolink CA750-PoE command injection in setWiFiWpsConfig](https://junglewise.ai/threats/cve-2026-9534-totolink-ca750-poe-command-injection-in-setwifiwpsconfig)
- [Totolink CA750-PoE command injection in recvUpgradeNewFw](https://junglewise.ai/threats/cve-2026-9533-totolink-ca750-poe-command-injection-in-recvupgradenewfw)
- [Totolink CA750-PoE command injection in setUploadUserData](https://junglewise.ai/threats/cve-2026-9532-totolink-ca750-poe-command-injection-in-setuploaduserdata)
- [Totolink CA750-PoE command injection in setUpgradeUboot](https://junglewise.ai/threats/cve-2026-9531-totolink-ca750-poe-command-injection-in-setupgradeuboot)
- [Totolink CA750-PoE command injection in setUnloadUserData](https://junglewise.ai/threats/cve-2026-9515-totolink-ca750-poe-command-injection-in-setunloaduserdata)