EUVD-2026-67909
GHSA-4j9g-3r37-7pj6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify TOTOLINK T6 management interface on network
-
DeliverySend unauthenticated POST to /cgi-bin/cstecgi.cgi with getSysStatusCfg action
-
ExploitReceive plaintext WiFi encryption keys and network configuration
-
ExecutionAuthenticate to WiFi using recovered credentials
-
ImpactPivot to LAN-side hosts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond network reachability to the router's HTTP management interface (typically port 80 or 8080). The /cgi-bin/cstecgi.cgi endpoint invoking getSysStatusCfg requires no authentication, no session cookie, and no prior interaction - a single POST request is sufficient. Exploitation is limited by: (1) network reachability - if remote management is disabled (a common SOHO default), WAN-side exploitation is blocked and an attacker must already have LAN or WiFi-adjacent access; (2) only firmware version 4.1.5cu.748_B20211015 is confirmed affected - adjacent firmware versions are unconfirmed; (3) physical proximity or foothold is required to leverage recovered WiFi credentials for wireless association. |
| Impact | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the unauthenticated, zero-complexity network attack surface and high confidentiality impact. SSVC rates Technical Impact as 'partial,' which may understate severity given that the leaked data includes WiFi encryption keys - credential-equivalent material enabling wireless network penetration beyond the router itself. EPSS is low at 0.12% (2nd percentile) and there is no CISA KEV listing, indicating no known active exploitation campaigns. However, SSVC confirms the attack is Automatable (yes), meaning mass-scanning tools could trivially enumerate exposed routers at scale. The absence of a vendor patch for the confirmed firmware version means there is currently no direct remediation path, increasing residual risk for deployed units. |
| Exploit ScenarioDerived | An attacker sends a single unauthenticated HTTP POST request to the router's /cgi-bin/cstecgi.cgi endpoint specifying the getSysStatusCfg action. The router returns a response containing the WiFi SSID, WPA encryption key, WAN and LAN IP addresses, firmware version, and serial number without requiring any session token or credentials. The attacker uses the recovered WiFi passphrase to associate with the wireless network, gaining LAN-side access for further lateral movement against connected hosts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated access to the getSysStatusCfg handler in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes a broad set of sensitive device data - including WiFi encryption keys, SSID, WAN/LAN IP addresses, firmware version, serial number, and connected client statistics - to any attacker with network reachability to the management interface. The exposure of raw WiFi key material is notably more impactful than a typical status-read disclosure: recovered credentials can be used to join the wireless network and pivot to LAN-side targets. No public exploit or active exploitation has been identified at time of analysis, though the attack is fully automatable via a single crafted POST request.
RemediationAI
No vendor-released patch has been identified at time of analysis for firmware 4.1.5cu.748_B20211015. As compensating controls, administrators should immediately disable WAN-side management access and restrict /cgi-bin/cstecgi.cgi to trusted LAN IP ranges only, preventing internet-facing exploitation without breaking local administration. Because WiFi encryption keys are included in the leaked payload, all wireless credentials should be treated as compromised and rotated immediately - change the WiFi passphrase and regenerate PSKs. If internet-facing management cannot be disabled, placing the management port behind a VPN or ingress firewall rule blocking external access is the next-best control. Monitor researcher coordination advisories at https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md and https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md for patch availability updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TOTOLINK T6 is a SOHO wireless router whose web management interface is served via a CGI dispatcher at /cgi-bin/cstecgi.cgi; the invoked handler is selected by a parameter in the POST body. The getSysStatusCfg function returns a structured payload containing device identity and network configuration but performs no authentication or authorization check before responding, constituting CWE-284 (Improper Access Control) rather than an authentication bypass of an existing gate. The NVD CPE entry carries the placeholder cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* instead of the correct TOTOLINK T6 identifiers, which impairs automated vulnerability management correlation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible unauthenticated endpoint; C:H justified by WiFi encryption key disclosure; no integrity or availability impact applies.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers expose WiFi encryption keys and network configuration through an unauthenticated remote handler, allowing attackers with management interface access to obtain credentials for LAN pivot attacks. Organizations using this router model face immediate risk of wireless network compromise and potential lateral movement into corporate networks.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management interface access via network-level controls (firewall rules, VPN requirement, administrative VLAN isolation); rotate WiFi credentials; implement continuous monitoring of the management interface for suspicious POST requests to getSysStatusCfg; segment wireless traffic from critical LAN assets; consider temporary isolation of affected devices if replacement timeline extends beyond 30 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB