Medium severity6.3NVD Advisory· Published May 26, 2026· Updated May 28, 2026

CVE-2026-9531

Description

A weakness has been identified in Totolink CA750-PoE 6.2c.510. Impacted is the function setUpgradeUboot of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dlink/DIR-816references
Totolink/CA750-PoEllm-fuzzy
Range: = 6.2c.510

Patches

Vulnerability mechanics

References

github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_54/54.mdnvd
vuldb.com/submit/813929nvd
vuldb.com/vuln/365558nvd
vuldb.com/vuln/365558/ctinvd
www.totolink.netnvd

News mentions

Totolink CA750-PoE: Nine OS Command Injection CVEs Land in a Single Batch
Vypr Intelligence · May 26, 2026

cvss	0.410
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000