Executive brief
A security vulnerability exists in the Totolink CA750-PoE, a wireless access point used for providing network connectivity. An attacker can exploit this flaw to take control of the device by sending a specially crafted request to the Wi-Fi configuration settings. If successful, this could allow an unauthorized user to disrupt network operations, intercept traffic, or use the device as a foothold to attack other systems on the corporate network.
Technical details
An OS command injection vulnerability (CWE-78) exists in the Totolink CA750-PoE firmware version 6.2c.510. The flaw is located within the 'setWiFiWpsConfig' function in the '/cgi-bin/cstecgi.cgi' binary (specifically within the wps.so library). The 'PIN' argument is processed without sufficient sanitization before being passed to a system command execution context. A remote attacker with low privileges (authenticated access to the setting handler) can inject arbitrary shell commands using backticks or other shell metacharacters. A public proof-of-concept demonstrates that an attacker can start a telnet daemon to gain a remote shell on the device.
Affected products
- Totolink CA750-PoE 6.2c.510
Timeline
- 2026-05-26: disclosed: Initial disclosure via VulDB and GitHub repository
- 2026-05-26: advisory: NVD publication date