EUVD-2026-67919
GHSA-79gx-m5qg-8x23
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP management interface
-
DeliverySend unauthenticated POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke getCrpcCfg without access control check
-
ExecutionReceive CRPC status and cloud URL
-
ImpactTarget cloud management endpoint
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required to trigger this vulnerability - the CVSS vector PR:N confirms unauthenticated access. The attack requires network reachability to the router's HTTP management interface on /cgi-bin/cstecgi.cgi. In default TOTOLINK T6 configurations, the management interface is typically accessible only from the LAN side, which limits exploitation to local network attackers or devices already on the same subnet. If WAN-side remote management has been enabled by the user (a non-default setting on most SOHO routers), exploitation becomes possible from the internet without any credentials. The affected firmware version must be 4.1.5cu.748_B20211015; other firmware versions are not confirmed as affected. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N rates this 7.5, but C:H overstates the sensitivity of the disclosed data - the leak is limited to cloud remote-control enablement status and a management URL, not credentials, session tokens, or full configuration. A more accurate independent assessment places this at C:L, yielding a score closer to 5.3. EPSS at 0.18% (7th percentile) confirms no meaningful automated exploitation activity. The vulnerability is not listed in CISA KEV. GitHub-hosted CVE coordination repositories (DarkBoulder, ShengWu00) reference this issue, indicating researcher awareness and potential for POC development, though no confirmed working exploit code is identified. Real-world risk is further bounded by the product's consumer SOHO footprint and the typical LAN-only exposure of the management interface on most default configurations. |
| Exploit ScenarioDerived | An attacker on the same local network - or with WAN management access enabled - sends a crafted HTTP POST request to http://[router-ip]/cgi-bin/cstecgi.cgi invoking the getCrpcCfg action. The router responds without requiring authentication, returning the CRPC status flag and cloud management URL. The attacker now knows whether cloud remote management is active and can target the cloud endpoint for further reconnaissance or abuse. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud remote-control (CRPC) status and management URL through the getCrpcCfg function. The /cgi-bin/cstecgi.cgi endpoint processes POST requests without enforcing access control, allowing any network-adjacent attacker to enumerate whether cloud remote management is active and retrieve its target URL. No public exploit has been identified at time of analysis and EPSS sits at the 7th percentile, indicating low current exploitation pressure despite the trivially simple attack vector.
RemediationAI
No vendor-released patch with a confirmed fix version has been identified at time of analysis. The TOTOLINK download page is referenced but does not specify a remediated firmware release. As a compensating control, administrators should restrict access to the router's management interface (port 80/443 on the LAN interface) using firewall rules or VLAN segmentation so that only trusted management hosts can reach /cgi-bin/cstecgi.cgi - this reduces the attack surface without disabling the device. Additionally, disabling cloud remote-control (CRPC) functionality in the router settings, if exposed through the UI, removes the value of the leaked data entirely. Monitor the TOTOLINK firmware download page (https://www.totolink.net/) for updated firmware releases.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TOTOLINK T6 is a consumer/SOHO wireless router running a CGI-based management interface at /cgi-bin/cstecgi.cgi. The getCrpcCfg function handles retrieval of Cloud Remote PC Control (CRPC) configuration, including the cloud management status flag and the URL of the cloud endpoint. CWE-284 (Improper Access Control) indicates the function lacks any authentication gate - it processes the POST request and returns configuration data without checking session tokens, credentials, or source IP restrictions. The affected firmware version is 4.1.5cu.748_B20211015. CPE data in the input uses the placeholder cpe:2.3:a:n/a:n/a which is incorrect; the correct product is totolink:t6_firmware.
Know when TOTOLINK gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Disclosed data is limited to CRPC status and cloud URL - not credentials or full config - so C:H overstates impact; C:L is appropriate.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers expose cloud remote-control configuration to any network-adjacent attacker without authentication, revealing whether remote management is active and its target URL. Organizations relying on these routers for branch or WAN connectivity face reconnaissance risk that could facilitate targeted attacks against remote access infrastructure. While no public exploit currently identified, the trivially exploitable nature and lack of vendor remediation create urgent need for interim controls.
No vendor-released patch identified at time of analysis. Disable CRPC functionality if not required for operations; implement network-layer access controls (firewall filtering, VLAN segmentation) to restrict /cgi-bin/cstecgi.cgi access from untrusted sources; monitor router access logs for unexpected getCrpcCfg requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Rated critical severit
TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via th
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Rated critical s
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th
Exploit-DB