EUVD-2026-67896
GHSA-5jpj-2wpc-xp99
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface (LAN/WAN)
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke getGenerateWiFiWpsPin without auth
-
ExecutionReceive newly generated WPS PIN
-
PersistAssociate to WiFi using PIN
-
ImpactPivot into internal network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to send an HTTP POST to the /cgi-bin/cstecgi.cgi endpoint invoking the getGenerateWiFiWpsPin function on a TOTOLINK T6 at firmware 4.1.5cu.748_B20211015 - no authentication, no user interaction, and no special configuration are needed (PR:N/UI:N/AC:L). The main practical limiter is network reachability of the management interface: by default this is a LAN/WiFi-facing admin service, so an attacker must be on or adjacent to the local network unless the web UI is deliberately WAN-exposed. WPS must be a supported/active feature on the device for the returned PIN to be usable for wireless association. |
| Impact | The signals are mixed. CVSS 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N) and the SSVC read (Automatable: yes, Technical Impact: total) argue for high priority: the attack is trivial, unauthenticated, and scriptable at scale. Against that, EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, SSVC exploitation status is 'none', and no POC is referenced - so there is no evidence of real-world exploitation yet, and the practical blast radius depends on WiFi radio proximity or an exposed management interface rather than pure internet-wide reachability. In practice a WPS PIN grants wireless network access, which is serious but not equivalent to full router RCE, so the 9.1 with I:H arguably overstates impact; the WPS-PIN theft is best treated as a strong confidentiality/access issue that any operator running exposed T6 units should remediate promptly even though the exploitation-probability data suggests targeted rather than widespread abuse. Verify the exposure surface: AV:N is scored, but WPS PIN abuse typically presumes the attacker can reach the LAN/WiFi or a WAN-exposed admin page. |
| Exploit ScenarioDerived | An attacker within WiFi range or with reach to an exposed management interface sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking getGenerateWiFiWpsPin, with no credentials, and receives a freshly generated valid WPS PIN. They then use that PIN to associate with the router's wireless network and pivot into the LAN. The attack requires no user interaction and is easily scripted; no public POC is currently referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated WPS PIN generation and disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker force the device to mint a new WiFi Protected Setup PIN and read it back by POSTing to the getGenerateWiFiWpsPin handler of /cgi-bin/cstecgi.cgi. Because the endpoint enforces no access control, any network-reachable attacker can obtain a valid WPS PIN and use it to join the wireless network. No public exploit identified at time of analysis, and EPSS is low (0.18%), but the flaw is machine-automatable and requires no credentials.
RemediationAI
No vendor-released patch identified at time of analysis; the references point to TOTOLINK's site and download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) plus coordination trackers (https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md), so check those for firmware superseding 4.1.5cu.748_B20211015 and apply it once published. Until a fixed image exists, apply compensating controls: disable WPS entirely in the router settings (removes the PIN-based join path this bug abuses, with the trade-off that WPS one-touch pairing is lost); ensure the web management interface (/cgi-bin/cstecgi.cgi) is not reachable from the WAN and restrict it to a trusted management VLAN or specific admin hosts (side effect: remote administration convenience is lost); and rotate/monitor the WiFi WPA credentials and watch for unexpected new wireless clients, since a stolen WPS PIN yields network access. If feasible, replace affected units where WPS cannot be disabled.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer/SOHO mesh WiFi router whose web management plane is driven by the CGI binary cstecgi.cgi, which dispatches JSON-style POST requests to internal handler functions keyed by a 'topicurl'/function name. The vulnerable getGenerateWiFiWpsPin handler is reachable without a session token, an instance of CWE-284 (Improper Access Control): the router fails to verify that the caller is authenticated/authorized before performing a privileged action. Rather than merely leaking existing configuration, this function actively generates a fresh WPS PIN and returns it, so it combines an integrity change (new PIN provisioned on the device) with confidentiality exposure (PIN handed to the caller). Exact affected-product identification from CPE is not possible here because the supplied CPE is the placeholder cpe:2.3:a:n/a:n/a:*; the real affected product is TOTOLINK T6 at firmware 4.1.5cu.748_B20211015 per the description.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network POST (AV:N/AC:L/PR:N/UI:N); stolen WPS PIN grants network access (C:H) and the device state changes with a new PIN (I:L); no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 allow any remote attacker to generate and retrieve valid WiFi credentials without authentication, enabling immediate wireless network compromise and lateral movement into organizational systems. Organizations using this device face direct unauthorized network access and potential data breach risk. No vendor patch currently exists to remediate this critical vulnerability.
Immediately disable WiFi Protected Setup (WPS) functionality on the router management interface if available. Implement strict network segmentation to isolate the router from critical business systems and databases. Enforce WPA3 encryption on all wireless networks supported by client devices. Monitor wireless access point logs continuously for unauthorized authentication attempts. Consider deploying an external managed WiFi solution to replace the affected device's wireless capability as an interim measure until replacement hardware is procured and deployed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB