EUVD-2026-68581
GHSA-f2f2-48gh-3rvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface (LAN or exposed WAN)
-
DeliveryCraft POST to /cgi-bin/cstecgi.cgi setWiFiEasyCfg
-
ExploitHandler applies config without auth check
-
ExecutionRewrite or disable wireless network
-
ImpactWi-Fi outage or weakened security
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web management service (default HTTP on /cgi-bin/cstecgi.cgi) and the ability to send a crafted POST invoking the setWiFiEasyCfg function; no credentials, tokens, or user interaction are needed because the handler lacks an access-control check. The primary limiting factor is exposure of the management interface: by default this is LAN-facing, so remote Internet exploitation is only possible where remote/WAN administration is enabled or the interface is otherwise reachable. Affected firmware is specifically T6 4.1.5cu.748_B20211015. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) treats this as a fully critical network-exploitable flaw, and the network/no-auth/low-complexity portion is consistent with the description. However, the confidentiality impact is overstated: setWiFiEasyCfg is a configuration setter, not a data-read primitive, so realistic impact is integrity (attacker rewrites Wi-Fi config) and availability (attacker disables the wireless network), not high confidentiality - I assess C:N. SSVC aligns with a real-but-not-urgent picture: Exploitation 'none' observed, Automatable 'yes', Technical Impact 'total'. EPSS is low (0.18%), no KEV listing, and no public PoC, so this is a genuine unauthenticated flaw but currently theoretical rather than actively weaponized. Practically, exposure depends on the web interface being reachable - devastating if the admin interface faces the WAN, largely LAN-limited otherwise - and any operator running affected T6 firmware should still prioritize patching given the trivial exploitation path and automatable nature. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface - an on-LAN guest, or anyone on the Internet if remote management is enabled - sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking setWiFiEasyCfg with attacker-chosen wireless parameters. Because no authentication is checked, the router applies the change, letting the attacker disable the SSID (denial of service) or weaken/rewrite Wi-Fi security to facilitate further access. No public PoC is currently identified, but the request is trivial to construct given the known endpoint and function name. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Unauthenticated wireless-network reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter or disable Wi-Fi settings by sending a crafted POST request to the setWiFiEasyCfg handler in /cgi-bin/cstecgi.cgi, which performs no access-control check. Any attacker able to reach the device's web interface can degrade or take down wireless connectivity and weaken Wi-Fi security parameters. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and there is no evidence of active exploitation.
RemediationAI
No fixed firmware version is identified in the available data, so no vendor-released patch can be cited at this time - check the TOTOLINK download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for a firmware release superseding 4.1.5cu.748_B20211015 and apply it once available. As compensating controls, ensure the router's HTTP management interface is not exposed to the WAN/Internet (disable remote administration), which closes remote reachability at the cost of losing off-LAN management; restrict access to /cgi-bin/cstecgi.cgi to trusted management hosts via firewall/ACL where the device supports it; and segment the router's management LAN from untrusted clients so an attacker on the guest/user network cannot reach the CGI endpoint. If the device is end-of-life or unpatched, plan replacement with a supported model, since the setter is unauthenticated by design of the flaw and cannot be authenticated via configuration alone.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer/SOHO mesh Wi-Fi router. Like many TOTOLINK devices it exposes a single CGI dispatcher, /cgi-bin/cstecgi.cgi, that routes JSON/form POST requests to internal function handlers by name - here setWiFiEasyCfg, which writes wireless configuration. The root cause is CWE-284 (Improper Access Control): the handler does not verify an authenticated/authorized session before applying configuration changes, so the privileged 'easy config' setter is reachable by anyone who can send a request. This is the write-side counterpart to the many TOTOLINK T6 getters/setters disclosed in the same coordination effort. The supplied CPE (cpe:2.3:a:n/a:n/a:*) is a non-informative NVD placeholder and does not identify the true product; the real affected product is the TOTOLINK T6 router firmware named in the description.
Know when TOTOLINK gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network setter with no auth check (AV:N/AC:L/PR:N/UI:N); write-only config gives integrity and availability impact but no data read, so C:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015 and prior) allow remote attackers to arbitrarily reconfigure or disable Wi-Fi networks without authentication; no public exploit identified at time of analysis, but the vulnerability requires no special access and affects all connected users. Organizations relying on these devices should prioritize identifying affected infrastructure and implementing protective controls immediately, as the low EPSS (0.2%) may not reflect emerging attacker interest once detailed technical information spreads.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restrict web-interface access via firewall to administrative networks only; (2) disable UPnP and remote management if enabled; (3) monitor router logs for suspicious POST requests to /cgi-bin/cstecgi.cgi; (4) implement network segmentation to prevent a compromised Wi-Fi configuration from affecting business-critical systems; (5) enforce strong, non-default admin credentials; (6) consider device replacement if no patched firmware is released within 90 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Rated critical severit
TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via th
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Rated critical s
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th
Exploit-DB