EUVD-2026-68538
GHSA-q54q-3xc2-qwqp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface on network
-
DeliveryCraft POST to /cgi-bin/cstecgi.cgi setWanIeCfg
-
ExploitBypass missing auth check
-
ExecutionOverwrite WAN/uplink configuration
-
ImpactRedirect traffic or disrupt connectivity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's HTTP management service and the ability to POST to the /cgi-bin/cstecgi.cgi endpoint invoking the setWanIeCfg function; per CVSS PR:N/UI:N no authentication or user interaction is needed. The practical limiting factor is exposure of that management interface: internet-wide exploitation requires WAN-side management to be enabled/reachable, whereas default deployments typically expose the interface only to the LAN, restricting attackers to the local segment or a compromised internal host. Confirmed affected build is firmware 4.1.5cu.748_B20211015 on the TOTOLINK T6; other firmware versions are not confirmed from the placeholder CPE data. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) rates this critical: network-reachable, low complexity, no privileges, no user interaction, consistent with the description of unauthenticated reconfiguration. However, the assigned C:H/I:H/A:N impact profile is debatable - the described action is writing uplink configuration (an integrity change) that can secondarily redirect traffic (some confidentiality) and disrupt connectivity (availability), rather than a direct high-confidentiality disclosure with zero availability effect; I weight this toward integrity with lower confidentiality and some availability impact. No EPSS score, no POC, and no KEV listing were provided, so despite the high CVSS the exploitation signal is currently unproven. Exposure is the dominant risk driver: routers with WAN-side or LAN-broad management exposure are far higher priority than those restricted to a trusted LAN. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking setWanIeCfg with attacker-chosen uplink parameters, without needing any credentials. Because the handler skips authorization, the router applies the new WAN configuration, letting the attacker redirect the upstream path or knock the device offline. No public POC is referenced, but the low complexity and unauthenticated single-request nature make exploitation straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Uplink/WAN reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) can be performed by unauthenticated remote attackers because the setWanIeCfg handler fails to enforce access control on the /cgi-bin/cstecgi.cgi endpoint. An attacker on a reachable network can silently rewrite the device's uplink settings, enabling traffic redirection or connectivity disruption. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; no EPSS score was provided.
RemediationAI
No vendor-released patched firmware version is identified in the provided data, so no fixed build can be cited at time of analysis; monitor the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-51675) for an update. As compensating controls, ensure the web management interface is not exposed on the WAN side (disable remote/Internet management), which stops Internet-based exploitation but not a malicious or compromised LAN host; restrict management access to a trusted management VLAN or specific admin IPs to shrink the attack surface at the cost of admin convenience; and place the device behind an upstream firewall that blocks inbound requests to /cgi-bin/cstecgi.cgi from untrusted segments. Where feasible, replace end-of-support TOTOLINK hardware, since these cstecgi.cgi access-control flaws recur across models.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the CGI-based web management interface common to TOTOLINK consumer/SOHO routers, where a single dispatcher binary (cstecgi.cgi) routes named functions such as setWanIeCfg based on POST body parameters. The root cause is CWE-284 (Improper Access Control): the setWanIeCfg function does not verify an authenticated/authorized session before applying WAN/uplink (IE) configuration changes, so the state-changing action is reachable pre-authentication. This class of flaw is recurrent in TOTOLINK's cstecgi.cgi handlers, where individual function endpoints inconsistently apply session checks.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network POST alters WAN config, so primarily integrity (I:H) with secondary traffic-redirection confidentiality (C:L) and connectivity-disruption availability (A:L); PR:N/AC:L per the missing auth check.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
The TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) contains a critical unauthenticated remote vulnerability enabling attackers to reconfigure network settings, risking internet service disruption and traffic interception for affected organizations. No vendor patch is currently available. Organizations deploying this router model require immediate containment and contingency planning to protect business continuity.
Restrict administrative access to router management interfaces to closed management networks only; implement continuous monitoring to detect unauthorized WAN configuration changes; establish redundant WAN connectivity paths to maintain service continuity if router compromise occurs; deploy network segmentation to isolate the router from critical systems; implement IP-based access control lists at upstream network devices to limit access attempts to vulnerable endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB