EUVD-2026-67877
GHSA-rgpq-5fw3-rxrm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface on network
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi (getSyslogCfg)
-
ExploitBypass missing auth check
-
ExecutionReceive syslog configuration in response
-
ImpactUse disclosed data for further reconnaissance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web management interface and the ability to send a crafted POST request to the getSyslogCfg function of /cgi-bin/cstecgi.cgi; no authentication, credentials, or user interaction are needed (PR:N/UI:N confirmed by CVSS). The primary limiting factor is exposure of the management interface: by default the CGI is reachable from the LAN, so unauthenticated LAN-adjacent attackers can exploit it directly, while Internet-based exploitation additionally requires remote/WAN management to be enabled. Impact is limited to reading syslog configuration on the specific firmware build 4.1.5cu.748_B20211015 - it does not by itself grant write access or code execution. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) reflects trivial exploitability - network reachable, low complexity, no privileges or user interaction - which is accurate for the access-control bypass itself. However, the I:H (high integrity impact) is inconsistent with the description: getSyslogCfg is a read-only getter that only discloses syslog configuration, so there is no realistic integrity impact; C:H alone is defensible and I should be N. This makes 9.1 an overstatement of true severity. Corroborating signals point to low real-world urgency: EPSS is 0.18% (7th percentile), there is no KEV listing, and no public PoC is referenced. The 'Authentication Bypass' tag is consistent with the CWE-284 root cause. Net assessment: a genuine unauthenticated info-disclosure flaw worth patching on exposed devices, but not a high-priority actively-exploited threat; the headline CVSS overstates impact. |
| Exploit ScenarioDerived | An attacker with network access to the router's web interface (for example, on the same LAN, or over the Internet if remote management is enabled) sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking getSyslogCfg, with no credentials. The response returns the device's syslog configuration, potentially revealing remote log-server addresses and logging behavior useful for further reconnaissance. No public exploit code is referenced, but the request is trivial to reproduce given the AV:N/AC:L/PR:N/UI:N profile. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Configuration disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers read the device's syslog configuration by sending a crafted POST request to the getSyslogCfg handler of /cgi-bin/cstecgi.cgi. The affected CGI endpoint fails to enforce authentication (CWE-284), so any actor with network reachability to the web interface can retrieve logging settings. No public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and the CVE is not in CISA KEV.
RemediationAI
No vendor-released patched firmware version is identified at time of analysis; the references point to the general TOTOLINK download portal rather than a specific fixed build, so monitor https://www.totolink.net/ for a firmware update superseding 4.1.5cu.748_B20211015 and apply it once released. As compensating controls: ensure the router's web administration interface is not exposed to the WAN/Internet (disable remote management), which eliminates the AV:N exposure at the cost of losing remote administration; restrict LAN-side access to /cgi-bin/cstecgi.cgi to trusted management hosts via firewall/ACL where the platform supports it; and place the device on a segmented management VLAN to limit which clients can reach the CGI endpoint. Because the flaw only discloses syslog configuration, prioritize it below any T6 issues that permit configuration change or code execution.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer/SOHO mesh Wi-Fi router. Like most TOTOLINK devices, its web management interface routes all API actions through a single CGI binary, /cgi-bin/cstecgi.cgi, which dispatches on a 'topicurl'/function name supplied in the POST body. Here the getSyslogCfg action is reachable without a valid session, an instance of CWE-284 (Improper Access Control): the handler performs its read operation before (or without) validating that the request is authenticated. This is the same architectural weakness seen across a family of T6 getter/setter functions where individual CGI actions omit session checks. The affected product cannot be identified from the CPE, which is the placeholder cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*; the real product is TOTOLINK T6 per the description and the totolink.net advisory references.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network POST with no user interaction (AV:N/AC:L/PR:N/UI:N); read-only getter discloses config so C:H but I:N and A:N, unlike the input's I:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain syslog-related configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers deployed at remote sites and branch offices can be accessed by unauthorized network users to extract configuration details about the device's logging setup. This configuration disclosure provides a reconnaissance vector that could inform subsequent attacks against these network infrastructure devices. While no active exploitation has been documented and exploitation likelihood is exceptionally low (EPSS 0.2%), organizations should promptly restrict management interface access and monitor vendor communications for remediation options.
No vendor-released patch identified at time of analysis. Restrict web management interface access via firewall rules to authorized administrative networks; disable remote management if operationally feasible; implement network segmentation to isolate affected devices from high-value assets; maintain access logging and monitor for patterns consistent with reconnaissance-phase activity against the management interface.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB