Totolink CA750-PoE CVE-2026-9513

Exploitation requires low-privilege authenticated access to the Totolink CA750-PoE management web interface - the CVSS 4.0 vector specifies PR:L (low privileges required), confirming that some level of authentication is needed, ruling out fully unauthenticated attacks. The vulnerable code path is specifically triggered through the NTP synchronization feature (NTPSyncWithHost function) in the Setting Handler component; the NTP sync functionality must be accessible to the authenticated user. No special platform configuration beyond default firmware operation appears required, as AC:L and AT:N indicate low complexity and no attack prerequisites. Exploitation is limited to: (1) having valid credentials (even low-privilege) or obtaining them via default passwords or brute force, and (2) network reachability to the management interface port - if the management interface is not exposed externally or is restricted to trusted networks, exploitation from untrusted networks is blocked.

The CVSS 4.0 score of 2.1 is strikingly low for an OS command injection and warrants independent scrutiny - the vector indicates network-reachable (AV:N), low complexity (AC:L), no special conditions (AT:N), and no user interaction (UI:N), all of which normally drive scores significantly higher. The anomaly lies in the impact metrics: VC:L/VI:L/VA:L with no subsequent system impact (SC:N/SI:N/SA:N), suggesting the scorer assessed that injected commands run in a restricted or sandboxed firmware context. Security teams should verify this independently - embedded firmware devices often lack robust process isolation, and a command injection may grant broader access than the CVSS scoring implies. The EPSS score of 2.95% at the 87th percentile is a stronger signal: despite no confirmed active exploitation (not in CISA KEV), this CVE ranks higher in exploitation likelihood than ~87% of all known CVEs, driven by the combination of network accessibility, low attack complexity, and publicly available PoC. The exploit proof-of-concept published on GitHub (E:P in the CVSS vector) makes this trivially reproducible. No vendor patch has been identified at time of analysis. For network-exposed management interfaces on PoE switches, this represents a meaningful operational risk even at low CVSS score.

An attacker with low-privilege access to the Totolink CA750-PoE management interface (e.g., a guest credential, a default or weak password) sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi, injecting shell metacharacters into the host_time parameter during an NTP sync operation - for example, appending '; <malicious_command>' to the argument. The firmware's NTPSyncWithHost function passes this value unsanitized to a shell command, executing attacker-controlled OS commands on the device. A public PoC demonstrating this technique is available at https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_51/51.md.