ByteOS Network

CVE Vulnerability Details :

CVE-2026-9513

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-25 May, 2026 | 22:30

Updated At-25 May, 2026 | 22:30

▼CVE Numbering Authority (CNA)

Totolink CA750-PoE Setting cstecgi.cgi NTPSyncWithHost os command injection

A weakness has been identified in Totolink CA750-PoE 6.2c.510. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Executing a manipulation of the argument host_time can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

Affected Products

Vendor

TOTOLINK

Product

CA750-PoE

CPEs

cpe:2.3:a:totolink:ca750-poe:*:*:*:*:*:*:*:*

Modules

Setting Handler

Versions

Affected

6.2c.510

Problem Types

Type	CWE ID	Description
CWE	CWE-78	OS Command Injection
CWE	CWE-77	Command Injection

Type: CWE

CWE ID: CWE-78

Description: OS Command Injection

Type: CWE

CWE ID: CWE-77

Description: Command Injection

Metrics

Version	Base score	Base severity	Vector
4.0	5.3	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
3.0	6.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
2.0	6.5	N/A	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Version: 4.0

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Version: 3.0

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Version: 2.0

Base score: 6.5

Base severity: N/A

Vector:

AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Credits

reporter

Buoy_yes (VulDB User)

Timeline

Event	Date
Advisory disclosed	2026-05-25 00:00:00
VulDB entry created	2026-05-25 02:00:00
VulDB entry last update	2026-05-25 17:14:06

Event: Advisory disclosed

Date: 2026-05-25 00:00:00

Event: VulDB entry created

Date: 2026-05-25 02:00:00

Event: VulDB entry last update

Date: 2026-05-25 17:14:06

References

Hyperlink	Resource
https://vuldb.com/vuln/365513	vdb-entry technical-description
https://vuldb.com/vuln/365513/cti	signature permissions-required
https://vuldb.com/submit/813924	third-party-advisory
https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_51/51.md	exploit
https://www.totolink.net/	product