What is the CVSS score of CVE-2026-51643?

CVE-2026-51643 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-51643?

Within 24 hours, audit your inventory to identify all TOTOLINK T6 routers currently deployed, with priority given to internet-facing or externally accessible devices. Within 7 days, implement network-based compensating controls by disabling remote management features, restricting the router's web interface to internal-only IP ranges, and applying firewall rules to block external access to ports 80 and 443 on those devices. Within 30 days, establish continuous monitoring for TOTOLINK vendor security advisories and evaluate replacement with actively supported router alternatives if any T6 units serve critical network functions.

TOTOLINK T6 CVE-2026-51643

EUVD-2026-67923 CRITICAL

Improper Access Control (CWE-284)

2026-08-28 mitre

GHSA-qr9r-gw2q-g279

Authentication Bypass

9.1

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach router web interface
Exploit

Send crafted POST to cstecgi.cgi
Execution

Invoke getNtpCfg without auth
Impact

Receive NTP config and system time

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network reachability to the TOTOLINK T6 management web server (default LAN-facing; internet-facing only if remote/WAN administration is enabled) and the ability to send a POST request to /cgi-bin/cstecgi.cgi targeting the getNtpCfg function on firmware 4.1.5cu.748_B20211015. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are needed. The main limiting factors are that the endpoint must be reachable (WAN exposure is not default) and that the disclosed data is limited to NTP configuration and current time, so there is no code execution or credential exposure from this flaw alone.
Impact	The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1 Critical) claims both high confidentiality and high integrity impact, but this conflicts with the description, which states only that NTP configuration and current time are disclosed - a read-only information leak with no stated modification capability. The high integrity rating therefore appears overstated; a more defensible assessment is a low-severity confidentiality-only issue. Corroborating this, EPSS is very low (0.18%, 7th percentile), there is no KEV listing and no known POC, so exploitation is neither confirmed nor probable in the near term. Net: the attack is trivially reachable (network, no auth, low complexity), but the value of what an attacker gains is minimal, making this a low real-world priority despite the Critical label - verify the true impact scope with the vendor before treating it as a 9.1.
Exploit ScenarioDerived	An attacker on the same network (or the internet, if WAN management is enabled) sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking getNtpCfg and receives the router's NTP configuration and current time without any credentials. No public POC is known, but the request is trivial to construct given the low attack complexity; the gained information could support fingerprinting or timing-related reconnaissance of the device.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 01, 2026

Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read the device's NTP configuration and current system time by sending a crafted POST request to /cgi-bin/cstecgi.cgi and invoking the getNtpCfg handler, which performs no access-control check. No public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), indicating little observed exploitation interest despite the high advertised CVSS. The leaked data is low-sensitivity, so real-world impact is far smaller than the 9.1 score suggests.

RemediationAI

No vendor-released patch version is identified at time of analysis; check the TOTOLINK download/advisory page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for updated T6 firmware superseding 4.1.5cu.748_B20211015 and apply it once published. As compensating controls, restrict access to the router's HTTP management interface so the /cgi-bin/cstecgi.cgi endpoint is not reachable from the WAN or untrusted LAN segments - disable remote/WAN administration entirely (trade-off: loses remote management convenience) and place management on an isolated VLAN or ACL-limited to trusted admin hosts (trade-off: added network configuration). Because the leak exposes NTP settings and time only, prioritization can be low, but these controls also mitigate the broader class of unauthenticated cstecgi.cgi functions on this device.

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is the cstecgi.cgi CGI endpoint on TOTOLINK T6 consumer/SOHO Wi-Fi routers, a common design in TOTOLINK firmware where a single CGI dispatches to named functions (here getNtpCfg) selected by request parameters. The root cause is CWE-284 (Improper Access Control): the getNtpCfg function does not verify that the caller is authenticated or authorized before returning NTP server settings and the device clock, so any network-reachable client can invoke it. The supplied CPE (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not correctly identify the vendor/product; the real target is TOTOLINK's T6 firmware, and the flaw is in embedded web-management logic rather than a general-purpose application.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI 5.3 MEDIUM

Unauthenticated remote read of low-sensitivity NTP config/time only, so C:L and I:N/A:N; the input's C:H/I:H is unsupported by the disclosure-only description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Sep 01, 2026 - 16:22 NVD

9.1 (CRITICAL)

CVE Published

Aug 28, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 28, 2026 - 00:00 cve.org

CRITICAL 9.1

DescriptionCVE.org

Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive ViewAI

Why It Matters

TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) contain an unauthenticated remote vulnerability allowing extraction of network time settings and system time, rated CVSS 9.1. Despite the baseline severity score, real-world organizational impact is minimal because only non-sensitive NTP configuration data is exposed; observed exploitation risk is negligible (0.2% EPSS), and the vulnerability does not enable account compromise or unauthorized network access.

Business Impact: Low

Compensating Controls

Disable remote administration access on affected routers; restrict web management interface to internal networks only via firewall ingress rules; block external POST requests to /cgi-bin/cstecgi.cgi; enable device logging and implement monitoring alerts for suspicious access patterns to the management interface.

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Prevalence

Low

consumer/SOHO TOTOLINK router, niche footprint, not enterprise-standard

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.