CVE-2026-51725: n/a

This vulnerability arises from improper access control in the NTPSyncWithHost function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling them to change the device's system clock. The CVSS v3.1 score is 9.1, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an unauthenticated attacker to modify the device clock, which can lead to potential disruption of time-dependent functions and compromise of system integrity and confidentiality. Availability is not impacted. The high CVSS score indicates a critical severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device to untrusted networks.