EUVD-2026-68542
GHSA-mhch-vx27-6f9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliveryCraft POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke setPasswordCfg unauthenticated
-
ExecutionOverwrite admin password
-
ImpactFull administrative device takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's web management endpoint /cgi-bin/cstecgi.cgi and the ability to send a POST invoking the setPasswordCfg function; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are needed against the affected T6 firmware 4.1.5cu.748_B20211015. The main limiting factor is exposure: by default the management interface is typically bound to the LAN, so remote (WAN) exploitation is only possible where remote administration has been enabled or the port is otherwise internet-exposed; attackers already on the local network face no such limit. |
| Impact | The signals are consistent and point to genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, and the outcome - resetting the admin account - is effectively full device compromise. One notable inconsistency is that the published vector encodes C:H/I:N/A:H, yet the described impact (changing administrator credentials) is fundamentally an integrity/authorization change; the I:N rating understates the true integrity impact and appears mis-scored. No EPSS score, KEV listing, or POC was provided, so probabilistic exploitation data is absent; the low-friction attack surface of an exposed router management endpoint nonetheless makes opportunistic scanning plausible if the interface is internet-facing. Absent KEV, this is not confirmed active exploitation, but the combination of zero prerequisites and total device takeover warrants prompt remediation where the device is exposed. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface - for example a device with remote management exposed to the internet, or an attacker on the same Wi-Fi/LAN segment - sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking setPasswordCfg with a new administrator password. Because no authentication is checked (AV:N/AC:L/PR:N/UI:N), the request succeeds without credentials or user interaction, locking out the legitimate owner and granting the attacker full control of the router. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 31, 2026
Administrator account takeover in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers overwrite the admin credentials by posting a crafted request to the setPasswordCfg handler on /cgi-bin/cstecgi.cgi. Because the endpoint enforces no access control, any attacker who can reach the web management interface can seize full administrative control of the device. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 9.1.
RemediationAI
No vendor-released patch version is identified in the provided data; the references are vendor-coordination READMEs (https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md and https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md) and the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html), so check that portal for a firmware build newer than 4.1.5cu.748_B20211015 and apply it once available. Until a fixed firmware is confirmed, the primary compensating control is to ensure the web management interface (HTTP/HTTPS) is not exposed to the WAN/internet - disable remote administration and block inbound access to the management port at the perimeter, which prevents remote exploitation at the cost of losing off-LAN management. Additionally restrict LAN-side access to /cgi-bin/cstecgi.cgi to trusted management hosts and monitor for unexpected admin-password changes; note these controls do not stop an attacker already present on the local network.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The T6 is a consumer/SOHO mesh Wi-Fi router whose web management backend is implemented by the cstecgi.cgi CGI binary, a common design across TOTOLINK firmware where individual configuration actions are dispatched by a 'topicurl'/function name in the POST body. The vulnerable setPasswordCfg function updates the administrator password but fails to verify that the caller is an authenticated administrator, matching CWE-284 (Improper Access Control). This is the same architectural pattern behind numerous prior TOTOLINK cstecgi.cgi advisories, where unauthenticated function dispatch repeatedly exposes privileged configuration routines.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Unauthenticated network dispatch (AV:N/AC:L/PR:N/UI:N); overwriting admin credentials is primarily integrity and availability (I:H/A:H), with no direct data disclosure so C:N - correcting the input's C:H/I:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are vulnerable to unauthenticated remote administrator account takeover, enabling attackers to seize complete control of network infrastructure without credentials. No patch is available from the vendor. Organizations must immediately identify and isolate affected devices to prevent compromise of network perimeter security and downstream systems.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict web interface access via firewall IP-based ACLs; disable remote management if operationally feasible; segment administrative traffic to isolated network; disable the vulnerable /cgi-bin/cstecgi.cgi endpoint if possible; implement continuous monitoring for credential changes and administrative interface access attempts; maintain audit logging of all web interface activity. These measures provide temporary risk reduction only and do not remediate the underlying vulnerability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB