The vulnerability CVE-2026-9531 affects Totolink CA750-PoE devices running firmware version 6.2c.510. It is caused by improper input handling in the setUpgradeUboot function of the /cgi-bin/cstecgi.cgi Setting Handler component. Specifically, the FileName parameter can be manipulated to inject arbitrary OS commands remotely. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Public exploit code is available, increasing the risk of exploitation, although no active exploitation has been confirmed.

Successful exploitation allows remote attackers to execute arbitrary OS commands on affected devices, potentially leading to unauthorized control or disruption of the device. The medium CVSS score indicates a moderate risk, with the possibility of system compromise if exploited. No evidence of exploitation in the wild has been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Totolink's official channels for updates. Until a patch is available, restricting remote access to the device's management interface and disabling unnecessary services may reduce exposure.