EUVD-2026-68544
GHSA-743p-6f2w-2c98
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router management interface
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke setRemoteCfg without auth
-
ExecutionEnable WAN-side administration
-
PersistAccess exposed admin over internet
-
ImpactAlter device configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's management web server and the ability to POST to /cgi-bin/cstecgi.cgi targeting the setRemoteCfg handler; per CVSS PR:N/UI:N no authentication or user interaction is needed. The primary limiting factor is reachability: by default the management interface is typically LAN-facing, so an attacker must already be on the LAN (or the device must have management exposed to the WAN) to reach the endpoint - the vulnerability itself is precisely what flips that WAN exposure on. Affected scope is confined to the TOTOLINK T6 at firmware 4.1.5cu.748_B20211015 as reported. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N, 9.1) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact and no availability impact - consistent with a router that gets its remote-management surface silently enabled/altered. No EPSS score, KEV listing, or POC reference is present in the supplied data, so exploitation is not confirmed as active or automated in the wild; this is a high-CVSS issue whose real-world exploitation signal is currently unproven. The practical risk is nonetheless significant because the flaw itself can expose the admin interface to the WAN, turning a LAN-only device into an internet-exposed target and potentially chaining into further attacks; treat the 9.1 as an upper bound pending confirmation that instances are internet-reachable in a vulnerable state. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking setRemoteCfg, with no credentials, to switch on WAN-side administration. With remote management now exposed, the attacker (or anyone on the internet) can subsequently reach the admin interface to read configuration and change security settings. No public POC is referenced, but the low complexity and lack of authentication make a working exploit trivial to develop. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 31, 2026
Exposure of WAN-side administration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers reconfigure the device by sending a crafted POST request to the setRemoteCfg handler in /cgi-bin/cstecgi.cgi. Because the endpoint fails to enforce authentication (CWE-284), an attacker can enable remote administration and alter security-relevant settings without any credentials. No public exploit is identified at time of analysis, but the flaw carries a CVSS 9.1 and is tagged as an authentication bypass.
RemediationAI
No vendor-released patch version is identified at time of analysis; the references point to the TOTOLINK T6 firmware download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) and vendor-coordination READMEs rather than a specific fixed build, so administrators should monitor that page for a firmware release superseding 4.1.5cu.748_B20211015 and apply it once published. As compensating controls, explicitly disable remote/WAN-side management on the device and, on the upstream gateway or ISP-facing interface, block inbound access to the router's HTTP/HTTPS management ports and to /cgi-bin/cstecgi.cgi from untrusted networks (trade-off: legitimate remote administration is lost). Where possible, place the device behind a separate firewall or restrict management to a trusted LAN/VPN segment, and audit current settings to confirm remote administration has not already been enabled by an attacker; consult the VulDB advisory (https://vuldb.com/vuln/397320) for corroborating detail.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is TOTOLINK's cstecgi.cgi, the monolithic CGI dispatcher used across many TOTOLINK consumer routers to service configuration RPC calls; requests select an internal handler (here setRemoteCfg) via POST parameters. The root cause is CWE-284 (Improper Access Control): the setRemoteCfg function does not verify that the caller is an authenticated administrator before applying changes that govern WAN-side (internet-facing) management access. This class of flaw is recurrent in TOTOLINK's cstecgi.cgi across models and firmware, where individual handlers rely on implicit trust rather than a centralized session/authentication check.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network POST to cstecgi.cgi with no user interaction (AV:N/AC:L/PR:N/UI:N); exposes admin config and allows setting changes (C:H/I:H) with no direct availability loss (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) contain a critical authentication bypass allowing unauthenticated attackers from the internet to reconfigure the device, including enabling remote administration and modifying security settings. This exposes the network edge and enables attackers to pivot into internal systems. Organizations using this model face immediate risk of perimeter compromise and potential data theft without patched firmware or compensating network controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable WAN-side administration and remote management features; (2) Implement firewall rules blocking external access to administrative interfaces (ports 80, 443, 8080); (3) Deploy network segmentation isolating router from critical systems; (4) Configure IDS/IPS to monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi; (5) Enable detailed logging of configuration changes and failed authentication attempts; (6) Schedule device replacement within 30 days as permanent remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB