CVE-2026-9533 | Totolink CA750-PoE 6.2c.510 Setting /cgi-bin/cstecgi.cgi recvUpgradeNewFw fwUrl/magicid os command injection

A vulnerability was found in Totolink CA750-PoE 6.2c.510. It has been classified as critical. The impacted element is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Performing a manipulation of the argument fwUrl/magicid results in os command injection.

This vulnerability is cataloged as CVE-2026-9533. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.