CVE-2026-9513 | Totolink CA750-PoE 6.2c.510 Setting /cgi-bin/cstecgi.cgi NTPSyncWithHost host_time os command injection

A vulnerability classified as critical was found in Totolink CA750-PoE 6.2c.510. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Executing a manipulation of the argument host_time can lead to os command injection.

This vulnerability is tracked as CVE-2026-9513. The attack can be launched remotely. Moreover, an exploit is present.