EUVD-2026-68716
GHSA-88wq-fpq9-cjr7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke NTPSyncWithHost without auth
-
ExecutionSet arbitrary device clock
-
ImpactDisrupt time-dependent functions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the router's web management interface (/cgi-bin/cstecgi.cgi) and the ability to send a crafted POST invoking the NTPSyncWithHost function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 - no authentication, credentials, or user interaction (PR:N/UI:N/AC:L). The primary limiting factor is exposure of the HTTP management interface: if remote/WAN administration is disabled, the attacker must already be on the local network, confining the attack to LAN-adjacent adversaries. Impact is bounded to changing the device clock; it does not by itself grant configuration takeover, code execution, or data access. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) rates this Critical with high confidentiality and integrity impact, but this conflicts with the description, which limits the attacker's capability to changing the device clock - an integrity effect with no obvious confidentiality loss. The C:H/I:H assignment therefore appears overstated; a clock change is realistically a low-to-moderate integrity issue (it can disrupt TLS/certificate validation, logging timestamps, scheduled tasks, or time-based ACLs, but does not by itself yield data disclosure or code execution). No EPSS score, KEV listing, or POC is provided, so there is no evidence of active or imminent exploitation. Net: the network-reachable, unauthenticated nature is genuinely concerning and easy to trigger, but the real-world severity is well below the 9.1 headline - treat as a real but lower-priority integrity/hardening issue rather than a critical breach vector. Verify the impact rating with the vendor before escalating. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface (e.g., a device with WAN management exposed, or any host on the same LAN) sends a single crafted unauthenticated POST to /cgi-bin/cstecgi.cgi invoking NTPSyncWithHost, setting the system clock to an arbitrary value. With AV:N/AC:L/PR:N/UI:N this needs no credentials, user interaction, or special timing; a skewed clock can then break TLS validation, corrupt log timestamps, or disrupt time-dependent rules. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 31, 2026
Clock manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers alter the device system time by sending a crafted POST request to the NTPSyncWithHost handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so no credentials are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the assigned CVSS 9.1 appears inflated relative to the described 'change the clock' impact.
RemediationAI
No vendor-released patched firmware version is identified at time of analysis; the references point to TOTOLINK's general site and download/advisory page rather than a specific fixed build, so check https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html for an updated firmware for the T6 and apply it once available. As compensating controls: restrict access to the router's HTTP management interface so /cgi-bin/cstecgi.cgi is not reachable from the WAN or untrusted LAN segments (disable remote/WAN administration entirely - trade-off: no off-network management), and place the device behind a firewall that blocks inbound access to the web management port from the internet. Because the impact is clock manipulation, also avoid relying on the router's local time for security-sensitive functions and prefer an independent, authenticated NTP source for downstream systems. These controls reduce exposure but do not fix the underlying missing authentication check.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TOTOLINK routers expose a CGI management interface through /cgi-bin/cstecgi.cgi, a single entry point that dispatches to named functions (here NTPSyncWithHost) based on parameters in the POST body. NTP synchronization normally sets the device clock from a configured time host; the flaw is that this function can be invoked without authentication. The root cause is CWE-284 (Improper Access Control) - a privileged configuration action is reachable by any network client because the CGI dispatcher does not verify the caller's session before executing the handler. The supplied CPE (cpe:2.3:a:n/a:n/a) is a placeholder and does not usefully identify the product; the affected target is the T6 hardware/firmware, not a generic application.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network access (AV:N/PR:N/AC:L) but the only described effect is changing the clock, an integrity-only impact (I:L) with no confidentiality or availability loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 can be remotely manipulated by unauthenticated attackers to alter system time, affecting the integrity of device logging, time-based authentication mechanisms, and network operations. This vulnerability exposes all affected devices deployed on network perimeters without requiring any credentials or user interaction.
Restrict network access through firewall rules blocking POST requests to /cgi-bin/cstecgi.cgi; implement network segmentation limiting device access to trusted management subnets only; monitor system logs for unauthorized time changes; disable remote management interfaces if operationally feasible. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB