Description

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T14:17:15.037Z",
  "pubdate": "2026-08-31T14:17:15.037Z",
  "executiveSummary": "The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015) contains an incorrect access control vulnerability within the setNtpCfg function. This flaw allows unauthenticated remote attackers to modify system time synchronization settings without valid session credentials. By intercepting or crafting a specific POST request targeting the /cgi-bin/cstecgi.cgi endpoint, an attacker can manipulate NTP server configurations. This vulnerability represents a significant security risk, as it permits an attacker to perform time-based attacks, manipulate log timestamps to obfuscate malicious activities, or facilitate man-in-the-middle attacks by directing the device to synchronize with an adversary-controlled NTP server. The exploit does not require prior authentication, meaning any network entity with access to the device management interface can leverage this flaw. Successful exploitation results in the compromise of time-integrity, which is critical for security protocols, cryptographic certificate validation, and forensic auditing.",
  "technicalDetails": "The vulnerability resides in the backend logic of the /cgi-bin/cstecgi.cgi script, specifically within the setNtpCfg function. The root cause is the absence of robust access control checks or session validation before the function processes user-supplied input. Under normal circumstances, administrative functions such as NTP configuration should be protected by an authentication mechanism, such as session cookies or token-based authorization. However, the implementation fails to enforce these requirements for the setNtpCfg call, rendering the configuration parameters exposed to any request that reaches the cstecgi.cgi handler.\nThe attack flow begins with the attacker constructing a malicious POST request directed at the /cgi-bin/cstecgi.cgi endpoint. This request is designed to pass parameters typically processed by the setNtpCfg function. Since the application does not verify the requester's identity, it blindly accepts the POST parameters—such as the NTP server IP address or domain—and updates the internal configuration file or NVRAM parameters accordingly. Because the function lacks parameter validation and authentication gating, the system state is modified immediately upon receipt of the request.\nThe technical impact involves the ability to force the device to synchronize with an arbitrary NTP source. By redirecting the device's time synchronization source, an attacker can induce a drift in the system clock. This synchronization manipulation can be used to bypass security controls that rely on time-sensitive authentication tokens or to invalidate existing cryptographic certificates, potentially leading to denial-of-service conditions or facilitating secondary exploitation through traffic interception and relay attacks. The vulnerability affects TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. Given that the management interface is often exposed to the local network or, in misconfigured environments, the WAN, the exploit surface is extensive. No privilege escalation is required as the application exposes the administrative function directly to unauthenticated requests. The lack of input sanitization within the setNtpCfg function further compounds the issue, as it may potentially allow for secondary vulnerabilities if the input fields are not properly handled before being passed to underlying system calls."
}