A flaw has been identified in the CA750‑PoE firmware 6.2c.510 that allows remote manipulation of the PIN argument to the setWiFiWpsConfig function within the cstecgi.cgi Setting Handler component. The vulnerability permits execution of arbitrary operating system commands, effectively granting an attacker the ability to run code on the device. The impact is the potential compromise of the router’s stability, confidentiality, and integrity, as attackers can administrate the device, alter configurations, or install further malware.

This issue affects all devices identified as Totolink CA750‑PoE running firmware 6.2c.510. No additional version information is supplied, so earlier firmware revisions may also be susceptible depending on code similarity.

The problem can be triggered remotely through the web interface, meaning a threat actor does not need physical access. The CVSS score of 5.3 indicates a moderate-level vulnerability; however, the lack of an EPSS score and absence from the KEV catalog provide no statistical data on current exploitation probabilities. Published exploits are available, so if the device is exposed to untrusted networks or remote management is enabled, the risk of a real-world compromise is significant. The primary attack vector is through HTTP requests to the CGI script, typically reaching the router from outside the local network.