CVE-2026-51673: n/a

This vulnerability arises from improper access control in the setNtpCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling them to change the device's time synchronization configuration without authorization. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 7.5, reflecting its high impact on integrity with no confidentiality or availability impact.

Exploitation of this vulnerability allows an unauthenticated attacker to alter the time synchronization settings of the affected device. While this does not directly compromise confidentiality or availability, it can affect the integrity of system logs and time-dependent operations, potentially undermining forensic investigations or causing operational issues reliant on accurate time.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the device's management interface to trusted users only and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi.