Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiEasyGuestCf handler on /cgi-bin/cstecgi.cgi with no credentials, creating or weakening the guest wireless network configuration. An attacker can enable or reconfigure guest WiFi to broaden its reach or lower its security, providing an unauthorized foothold onto the local network. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis, though the missing-authorization pattern is trivial to script.
Improper access control in the delVlanCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete VLAN configuration entries by POSTing to the /cgi-bin/cstecgi.cgi CGI endpoint. Removing VLAN entries collapses network segmentation, which can break isolation between trusted and guest/IoT segments and disrupt connectivity. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.
Unauthenticated wireless-configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers reach the setWiFiAdvancedCfg handler through the /cgi-bin/cstecgi.cgi endpoint without credentials and alter advanced Wi-Fi settings to degrade wireless service. The flaw is an improper access-control (CWE-284) issue on a CGI function that should require authentication. No public exploit has been identified at time of analysis, and EPSS is low (0.18%, 7th percentile), indicating little observed exploitation interest so far.
Unauthenticated WAN configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter upstream provisioning and connectivity by POSTing a crafted request to the setWanCfg handler of /cgi-bin/cstecgi.cgi, with no login required. The setWanCfg function performs no access-control check (CWE-284), so an attacker can rewrite WAN/uplink settings - potentially redirecting or severing the device's internet connectivity. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the flaw is not in CISA KEV.
Improper access control in the setUpgradeFW function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers alter the firmware-upgrade workflow by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Because the CGI endpoint enforces no authentication, an attacker on a reachable network can tamper with the device's firmware update process, risking integrity compromise and denial of service (bricking). EPSS is low (0.18%, 7th percentile) and there is no public exploit or KEV listing at time of analysis.
Unauthenticated log erasure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers wipe system logs by sending a crafted POST request to the clearSyslog handler at /cgi-bin/cstecgi.cgi, with no credentials required. The flaw is an incorrect-access-control (CWE-284) gap on an administrative maintenance function that should be privileged. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.18% (7th percentile), consistent with a niche consumer-router target rather than mass exploitation.
Unauthenticated policy tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers overwrite URL/browsing filter rules by posting to the /cgi-bin/cstecgi.cgi endpoint's setUrlFilterRules function without any credentials. The flaw is a broken access-control check (CWE-284) reported by MITRE with a CVSS of 9.1; no public exploit is identified at time of analysis and EPSS is low (0.18%, 7th percentile).
Missing authorization in the setWiFiGuestCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers create or weaken the guest wireless network by POSTing a crafted request to /cgi-bin/cstecgi.cgi. Because the setter applies configuration without any session or credential check, an attacker can stand up an open/weakly-secured guest SSID or downgrade guest isolation without ever authenticating. No public exploit is identified at time of analysis and EPSS is low (0.16%), but exploitation is trivial against the affected build.
Unauthenticated tampering with mesh Wi-Fi pairing on the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers manipulate the device's mesh pairing state by posting to the setPairCfg handler of the cstecgi.cgi endpoint, with no credentials required. The flaw is an access-control gap (CWE-284) reported by MITRE; no public exploit code or active exploitation is currently identified, and EPSS is low (0.16%, 6th percentile), so risk is elevated by the trivial preconditions but not by observed attacker interest.
Unauthenticated device deletion in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers remove any managed slave device by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The delDevice function fails to enforce access control (CWE-284), so no credentials are needed. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), indicating limited observed interest despite the high CVSS 9.1 rating.
Incorrect access control in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers hijack the device's Wi-Fi repeater configuration via a crafted POST to /cgi-bin/cstecgi.cgi, repointing the router to an attacker-controlled upstream access point. No public exploit or CISA KEV listing is identified at time of analysis, and the EPSS probability is low (0.16%), but the flaw is network-reachable with no authentication.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers alter the WAN dial (internet connection) state by POSTing a crafted request to the setManualDialCfg handler in /cgi-bin/cstecgi.cgi. Rated CVSS 9.1 and flagged as an authentication bypass, it requires no credentials and no user interaction, though EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis. Only the vendor-coordination disclosure (VulDB/MITRE) exists - this is not in CISA KEV.
Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite IPTV service settings by posting a crafted request to the /cgi-bin/cstecgi.cgi endpoint's setIptvCfg handler. The CGI function fails to enforce any authentication or authorization check, so anyone able to reach the web management interface can alter service configuration. No public exploit code has been identified and EPSS is low (0.16%), but the flaw is trivially reachable (CVSS 9.1, AV:N/AC:L/PR:N).
Unauthenticated custom-CGI-module installation on the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers plant attacker-controlled CGI code through the UploadCustomModule handler in /cgi-bin/cstecgi.cgi. Because the endpoint enforces no authentication or access control, a single crafted POST request installs an executable module - effectively arbitrary code execution on the device. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile), indicating no observed mass exploitation yet.
Operating-mode tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers alter the device's operating mode by POSTing to the /cgi-bin/cstecgi.cgi endpoint, because the setOpModeCfg handler performs no access-control check. An attacker on the network path can reconfigure how the router operates (e.g. router/AP/repeater mode), disrupting connectivity or repositioning the device for further attack. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.
Exposure of WAN-side administration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers reconfigure the device by sending a crafted POST request to the setRemoteCfg handler in /cgi-bin/cstecgi.cgi. Because the endpoint fails to enforce authentication (CWE-284), an attacker can enable remote administration and alter security-relevant settings without any credentials. No public exploit is identified at time of analysis, but the flaw carries a CVSS 9.1 and is tagged as an authentication bypass.
Improper access control in the setLedCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers change the device's LED configuration by POSTing to the /cgi-bin/cstecgi.cgi endpoint. The flaw exposes a privileged configuration function without any authentication check, though its documented real-world impact is limited to altering LED behavior. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Administrator account takeover in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers overwrite the admin credentials by posting a crafted request to the setPasswordCfg handler on /cgi-bin/cstecgi.cgi. Because the endpoint enforces no access control, any attacker who can reach the web management interface can seize full administrative control of the device. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 9.1.
Uplink/WAN reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) can be performed by unauthenticated remote attackers because the setWanIeCfg handler fails to enforce access control on the /cgi-bin/cstecgi.cgi endpoint. An attacker on a reachable network can silently rewrite the device's uplink settings, enabling traffic redirection or connectivity disruption. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; no EPSS score was provided.
Access control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite the device's MAC filtering rules by sending a crafted POST request to the setMacFilterRules handler at /cgi-bin/cstecgi.cgi. Because no authentication is enforced, an attacker with network reachability to the web interface can alter which clients are permitted or blocked on the network. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the CGI attack surface on TOTOLINK devices is a well-established botnet target.
Server-side request forgery in QD (qd-today), an open-source HTTP timed-task/check-in framework, lets remote unauthenticated attackers coerce the server into issuing arbitrary HTTP(S) requests. The unauthenticated /har/test endpoint passes user-supplied JSON into Fetcher.build_request() (libs/fetcher.py), which builds a Tornado HTTPRequest with no validation of URL scheme, host, or IP range and with TLS verification disabled (validate_cert=False), so an attacker can reach internal services and cloud metadata endpoints. CVSS is 9.1; no public exploit identified at time of analysis, though a referenced GitHub gist may contain technical detail.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers read the device's roaming enablement flag by sending a crafted POST request to the getRoamingCfg handler at /cgi-bin/cstecgi.cgi. The flaw is an access-control failure (CWE-284) on a CGI endpoint that should require authentication, and it is reachable over the network with no user interaction. No public exploit code has been identified and it is not listed in CISA KEV, though the trivial request-based trigger makes reproduction straightforward.
Unauthenticated UPnP service-state manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers toggle the UPnP service by POSTing a crafted request to the /cgi-bin/cstecgi.cgi endpoint, because the setUPnPCfg handler enforces no access control (CWE-284). Any network-reachable attacker can enable UPnP without credentials, opening the door to attacker-controlled port mappings on the LAN. No public exploit is identified at time of analysis, and it is not in CISA KEV, though a VulDB advisory (397330) tracks it.
Improper access control in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 lets unauthenticated remote attackers invoke the setWiFiWpsStart function via a crafted POST request to /cgi-bin/cstecgi.cgi, forcing the device to open a WPS wireless pairing window without any credentials. Because WPS pairing enables a nearby attacker to join the wireless network, this exposes the LAN and its traffic to unauthorized access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify access-device policies by sending a crafted POST request to the setAccessDeviceCfg handler at /cgi-bin/cstecgi.cgi. Because no authentication is required (CVSS 9.1, AV:N/PR:N), an attacker on the network path can tamper with device access rules that govern which clients and controls apply to the LAN. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS is not provided.
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote, unauthenticated attacker delete Wi-Fi ACL (access control list) rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delWiFiAclRules handler. Because the handler performs no authentication or authorization check, anyone able to reach the device's web management interface can strip the MAC-based wireless access restrictions. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CISA's SSVC assessment rates it as automatable with total technical impact.
Clock manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers alter the device system time by sending a crafted POST request to the NTPSyncWithHost handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), so no credentials are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the assigned CVSS 9.1 appears inflated relative to the described 'change the clock' impact.
Firewall rule tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete IP/port filter rules by sending a crafted POST request to the delIpPortFilterRules handler in /cgi-bin/cstecgi.cgi. The missing access-control check means anyone able to reach the device's web interface can silently strip its firewall protections, exposing previously blocked internal services. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Information disclosure in the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers read pairing and mesh-slave configuration by sending a crafted POST request to the getPairCfg handler at /cgi-bin/cstecgi.cgi. The missing access-control check exposes mesh topology and pairing secrets that can facilitate deeper network compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS is not provided.
Improper access control in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify parental-control settings by sending a crafted POST request to the setParentalRules handler at /cgi-bin/cstecgi.cgi. The flaw requires no authentication and no user interaction, so anyone able to reach the device's web interface can alter or disable parental restrictions. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.