PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9513 Totolink CVE debrief

A command injection vulnerability exists in the NTPSyncWithHost function of the /cgi-bin/cstecgi.cgi endpoint on Totolink CA750-PoE devices running firmware version 6.2c.510. The host_time parameter accepts unsanitized input that is passed to a shell command, enabling authenticated remote attackers to execute arbitrary operating system commands. The vulnerability requires low privileges and no user interaction, with network-based attack vector. Public exploit availability increases practical risk despite the LOW CVSS severity rating. The affected component is the Setting Handler's NTP synchronization functionality.

Vendor
Totolink
Product
CA750-PoE
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-07-23
Advisory published
2026-05-25
Advisory updated
2026-07-23

Who should care

Network administrators managing Totolink CA750-PoE wireless access points; security teams responsible for network infrastructure hardening; organizations using these devices in production environments

Technical summary

The NTPSyncWithHost function in /cgi-bin/cstecgi.cgi fails to sanitize the host_time parameter before passing it to a shell command execution context. An authenticated attacker can inject shell metacharacters to execute arbitrary OS commands with the privileges of the web server process. The vulnerability is remotely exploitable with low privileges and requires no user interaction.

Defensive priority

medium

Recommended defensive actions

  • Restrict administrative access to the web management interface to trusted networks only
  • Implement network segmentation to isolate affected devices from untrusted networks
  • Monitor for suspicious requests to /cgi-bin/cstecgi.cgi containing shell metacharacters in host_time parameter
  • Apply vendor firmware updates when available
  • Disable remote web administration if not required
  • Review device logs for unauthorized NTP configuration changes

Evidence notes

Vulnerability disclosed via VulDB with public exploit reference. CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and no user interaction. CWE-77 and CWE-78 (command injection) identified as root cause. Exploit marked as publicly available per source metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9513 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9513

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9513 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9513

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.