EUVD-2026-67899
GHSA-jqcx-8w8w-r45g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router management port
-
DeliverySend unauthenticated POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke getWiFiEasyCfg action
-
ExecutionReceive SSID and Wi-Fi PSK in response
-
PersistAuthenticate to wireless network
-
ImpactGain LAN access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required against the TOTOLINK T6's web interface - the getWiFiEasyCfg endpoint accepts unauthenticated POST requests by design flaw. The primary prerequisite is network reachability to the router's HTTP management port (/cgi-bin/cstecgi.cgi); if the admin interface is LAN-only (the default for most consumer routers), exploitation is limited to local network attackers. If the WAN management port is enabled and internet-exposed, exploitation is trivially achievable remotely. No specific configuration beyond a default firmware install is required. The vulnerability does not require user interaction, elevated privileges, or prior system knowledge beyond the standard CGI endpoint path. |
| Impact | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly reflects the low-friction, unauthenticated, network-accessible nature of this flaw. However, EPSS places exploitation probability at just 0.18% (7th percentile), indicating that despite the easy attack path, mass exploitation is not currently observed. The device is not in CISA KEV. Real-world risk is meaningful for environments where this specific router model is internet-exposed - an attacker who can reach the management interface gains Wi-Fi credentials without any authentication, enabling network access or lateral movement. Risk is self-limiting to deployments where the CGI interface is reachable; if the admin panel is LAN-only or firewall-blocked, exposure is greatly reduced. The gap between high CVSS and very low EPSS is consistent with a niche consumer device with limited internet-exposed deployment scale. |
| Exploit ScenarioDerived | An attacker who can reach the TOTOLINK T6 management interface - either from the LAN or from the internet if the admin port is WAN-exposed - sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking the getWiFiEasyCfg action with no session token or credentials. The router responds with Wi-Fi configuration data including the SSID and pre-shared key, which the attacker then uses to authenticate to the wireless network and gain full LAN access. Researcher disclosure repositories associated with this CVE suggest the request structure is documented, lowering the skill bar for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes Wi-Fi credentials - including SSIDs and plaintext Wi-Fi keys - to any attacker on the network or internet who can reach the device's web interface. The getWiFiEasyCfg function in the CGI handler accepts POST requests without enforcing authentication, classifying this as CWE-284 improper access control rather than a logic bypass. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but two independent researcher disclosure repositories on GitHub reference this CVE, consistent with coordinated disclosure that may include proof-of-concept detail.
RemediationAI
Check the TOTOLINK firmware download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for a patched firmware release newer than 4.1.5cu.748_B20211015; no specific patched version is confirmed in available data, so a vendor-released fix cannot be cited with certainty. As an immediate compensating control, restrict access to the router's web management interface (port 80/443 on the WAN interface) to LAN-only via firewall rules - this eliminates the remote attack surface entirely. Additionally, change Wi-Fi credentials (SSID and PSK) as a precaution if the device was ever internet-exposed, since credentials may have already been harvested. Network segmentation placing the router management interface on a dedicated admin VLAN further limits lateral risk.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer/SOHO wireless router running a CGI-based web management interface exposed via /cgi-bin/cstecgi.cgi. The affected firmware version is 4.1.5cu.748_B20211015. The getWiFiEasyCfg function, intended to retrieve Wi-Fi Easy Config settings, fails to validate session authentication before returning its payload - a textbook CWE-284 (Improper Access Control) flaw. The CPE listed in NVD is a placeholder (cpe:2.3:a:n/a:n/a) and does not accurately identify the product; the correct affected platform is TOTOLINK T6 at the above firmware version. Credential data returned likely includes SSID names and pre-shared keys (PSK), enabling direct wireless network compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated endpoint; no complexity or interaction required; confidentiality impact only as credentials are disclosed but no write or availability effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an unauthenticated vulnerability that exposes Wi-Fi network credentials-SSIDs and plaintext encryption keys-to any attacker who can reach the device's web interface. Compromised Wi-Fi keys grant immediate network access, enabling attackers to intercept organizational traffic and pivot to connected systems. Organizations using this router model face material risk of network compromise if the device is internet-exposed or positioned in environments with untrusted users or guests.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) implement network firewall ACLs to restrict access to the device's web interface and disable external management access; (2) apply network segmentation to isolate the router's management interface from user-facing traffic; (3) monitor network for unauthorized Wi-Fi client connections and unexpected credential usage; (4) immediately cycle all Wi-Fi network credentials. These controls reduce attack surface but do not eliminate the underlying vulnerability-device replacement or confirmed patched firmware remains required for full remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB