Medium severity6.3NVD Advisory· Published May 26, 2026· Updated May 26, 2026

CVE-2026-9533

Description

A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The impacted element is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Performing a manipulation of the argument fwUrl/magicid results in os command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dlink/DIR-816references
Totolink/CA750-PoEllm-fuzzy
Range: = 6.2c.510

Patches

Vulnerability mechanics

References

github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_56/56.mdnvd
vuldb.com/submit/813937nvd
vuldb.com/vuln/365560nvd
vuldb.com/vuln/365560/ctinvd
www.totolink.netnvd

News mentions

Totolink CA750-PoE: Nine OS Command Injection CVEs Land in a Single Batch
Vypr Intelligence · May 26, 2026

cvss	0.410
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000