CVE-2026-51725

CVE-2026-51725 is an incorrect access control flaw (CWE-284) in the NTPSyncWithHost function of the TOTOLINK T6 router's web API, rated 9.1 (critical) on CVSS 3.1. An unauthenticated attacker triggers it by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which the device processes without requiring any credentials. Successful exploitation lets the attacker change the device's clock; the CVSS vector rates confidentiality and integrity impact as high with no availability impact, and clock manipulation can affect time-dependent behavior such as scheduled rules and logging. Only TOTOLINK T6 devices running firmware 4.1.5cu.748_B20211015 are named as affected in the available data. There is no known public PoC, the flaw is not in CISA KEV, and EPSS assigns a roughly 0.3% probability of exploitation within 30 days, so no in-the-wild exploitation is currently known.

What to do: Check T6 devices for firmware 4.1.5cu.748_B20211015 and upgrade to the newest T6 release published on TOTOLINK's support/download page once a fixed build is available (no fixed version is specified in the current data). As an interim mitigation, disable WAN-side remote management or restrict access to the router's web interface, including the /cgi-bin/cstecgi.cgi endpoint, to trusted hosts only. Monitor affected devices for unexpected clock changes or drift, which would indicate tampering.