EUVD-2026-67885
GHSA-3w2r-c4w7-whmh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach T6 web interface on network
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke getDiagnosisCfg without auth
-
ExecutionReceive diagnostic config and ping logs
-
ImpactHarvest network reconnaissance data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web management service (cstecgi.cgi) on firmware 4.1.5cu.748_B20211015 and a single crafted POST request invoking the getDiagnosisCfg function - no authentication, credentials, or user interaction are needed (PR:N/UI:N). The primary limiting factor is network position: the management interface must be reachable from the attacker (default deployments expose it to the LAN, so remote WAN exploitation depends on whether HTTP management is exposed on the WAN interface). Impact is bounded to reading diagnostic configuration and ping-log contents; the flaw does not by itself grant write access, code execution, or credential disclosure. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) reflects trivial unauthenticated network access, and SSVC concurs the flaw is automatable with total technical impact. However, the described behavior is read-only disclosure of diagnostic config and ping logs, so the I:H (High Integrity) impact appears overstated - the function does not modify device state; a C:H/I:N/A:N shape better matches the description, which would lower the true base score. Real-world urgency signals are modest: EPSS is only 0.18% (7th percentile), no POC is identified, and it is not in CISA KEV (SSVC exploitation: none). The practical risk is meaningful for internet-exposed devices (management reachable from WAN) but the leaked data is relatively low-sensitivity (network diagnostics and ping output rather than credentials), so this is a genuine but lower-tier priority than the raw 9.1 suggests. Note also that exposure hinges on whether the web interface is reachable from the attacker's network position, which the CVSS AV:N alone does not distinguish LAN from WAN. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface (e.g., a device with management exposed to the WAN, or an attacker already on the LAN) sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking getDiagnosisCfg, with no credentials, and receives the diagnostic configuration and any buffered ping-log output in the response. This requires no user interaction and is automatable, though no public exploit code has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read diagnostic configuration and stored ping-log contents by sending a crafted POST request to the getDiagnosisCfg handler at /cgi-bin/cstecgi.cgi. The endpoint performs no authentication check (CWE-284), so any network-reachable attacker can retrieve the data. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV, though CISA SSVC rates it as automatable with total technical impact.
RemediationAI
No vendor-released patch is identified at time of analysis; the references point to TOTOLINK's site and vendor-coordination trackers (https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md and https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md) rather than a fixed firmware build, so check the TOTOLINK download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for updated firmware superseding 4.1.5cu.748_B20211015 and apply it once released. As compensating controls, ensure the web management interface is not exposed on the WAN and restrict it to trusted LAN hosts (blocks remote unauthenticated access, with the trade-off of losing remote administration); place the device behind a firewall that blocks inbound access to the HTTP management port and specifically to /cgi-bin/cstecgi.cgi from untrusted segments; and monitor for anomalous POST requests to that endpoint. If the device is end-of-support, plan replacement, as unpatched cstecgi.cgi endpoints in this family are a recurring exposure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TOTOLINK T6 is a consumer mesh/router product whose web management backend is driven by the CGI binary cstecgi.cgi. Requests are dispatched to named handler functions (here getDiagnosisCfg) selected by a JSON 'topicurl'-style parameter in the POST body. The affected getDiagnosisCfg function returns the device's network-diagnostics settings and the buffered output of prior ping/diagnostic runs. The root cause is CWE-284 (Improper Access Control): this handler is reachable and returns data before any session/authentication validation, a pattern common across this firmware family's cstecgi.cgi endpoints. The supplied CPE (cpe:2.3:a:n/a:n/a) is a placeholder and does not correctly identify the vendor/product as TOTOLINK T6.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network read of diagnostic/ping data gives C:H, but the handler only discloses data so I:N and A:N, unlike the input's I:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) are vulnerable to unauthenticated information disclosure, enabling remote attackers to retrieve diagnostic configuration and ping logs without credentials. With no vendor patch available and no public exploit yet identified, organizations must implement immediate access controls to protect potentially sensitive diagnostic data on all deployed devices.
No vendor-released patch identified at time of analysis. Implement network segmentation and firewall rules to restrict access to affected TOTOLINK T6 routers-specifically block untrusted networks from reaching /cgi-bin/cstecgi.cgi via POST requests. Deploy comprehensive logging and alerting on all diagnostic configuration handler invocations to detect unauthorized access attempts. Evaluate replacement options with vendors offering robust patch management practices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB