EUVD-2026-68582
GHSA-2qw7-8xj4-xq6q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach LAN/WiFi-side web interface
-
DeliveryPOST setWiFiEasyGuestCf to /cgi-bin/cstecgi.cgi unauthenticated
-
ExploitBypass missing access control
-
ExecutionCreate or weaken guest wireless config
-
ImpactGain unauthorized network foothold
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to reach the router's web backend at /cgi-bin/cstecgi.cgi and issue a POST invoking the setWiFiEasyGuestCf function; per CVSS PR:N/UI:N no authentication or user interaction is needed. Limiting factors: the management CGI is normally exposed on the LAN/WiFi side, so the attacker must be on or adjacent to the local network unless remote administration is enabled; exploitation is confined to firmware 4.1.5cu.748_B20211015 of the TOTOLINK T6; and the concrete impact is limited to guest-wireless configuration changes rather than full device takeover. |
| Impact | Signals are mixed. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.1) describes a trivially reachable, unauthenticated network attack, which is credible for a LAN-facing CGI endpoint. However the C:H/I:H rating overstates confidentiality: setWiFiEasyGuestCf is a configuration-write ('set') operation whose direct effect is modifying guest WiFi settings, i.e. an integrity impact - it does not read out sensitive data, so C:H is not well supported. EPSS is low (0.18%, 7th percentile) and there is no KEV listing and no public PoC, indicating this is not currently a mass-exploited issue. Real-world reach is further constrained by attack surface: cstecgi.cgi is normally exposed on the LAN/WiFi side, so 'AV:N' realistically means an attacker already on or adjacent to the network unless remote management is enabled. Net: a real defect worth patching on affected units, but a lower operational priority than the raw 9.1 suggests. |
| Exploit ScenarioDerived | An attacker who has joined the WiFi or gained a position on the LAN sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking setWiFiEasyGuestCf, with no login. The request enables or weakens the guest wireless network (for example broadening its access or lowering its protection), giving the attacker or others an unauthorized wireless entry point into the environment. No exploit code is publicly identified, but the request is simple to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiEasyGuestCf handler on /cgi-bin/cstecgi.cgi with no credentials, creating or weakening the guest wireless network configuration. An attacker can enable or reconfigure guest WiFi to broaden its reach or lower its security, providing an unauthorized foothold onto the local network. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis, though the missing-authorization pattern is trivial to script.
RemediationAI
No fixed firmware version is identified in the provided data, so no vendor-released patch is confirmed at time of analysis - check the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for a build newer than 4.1.5cu.748_B20211015 and apply it once available. As compensating controls: disable the guest wireless / 'Easy Guest' feature if not needed so that a forced reconfiguration has no live SSID to abuse; ensure remote/WAN web management is turned off so cstecgi.cgi is not internet-reachable (trade-off: no off-LAN administration); and restrict LAN-side access to the router's management interface, since any device on the network can currently reach the endpoint. Given the age of this firmware, consider replacing end-of-support hardware if the vendor issues no fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The T6 is a consumer mesh/router whose web management backend routes all administrative actions through a single CGI dispatcher, /cgi-bin/cstecgi.cgi, which selects an internal handler by a function name supplied in the POST body. CWE-284 (Improper Access Control) is the root cause: the setWiFiEasyGuestCf handler - responsible for provisioning the 'Easy Guest' wireless SSID - does not verify that the caller holds an authenticated administrative session before applying configuration changes. This is the same missing-server-side-authorization defect seen across the broader TOTOLINK T6 cstecgi.cgi command set, where numerous get*/set*/del* functions are individually reachable pre-authentication. The CPE is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not name the real product.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network-reachable CGI (AV:N/AC:L/PR:N/UI:N); the function writes guest-WiFi config, so integrity is high while it reads no data (C:N) and does not disrupt service (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) allow unauthenticated remote attackers to create or reconfigure guest WiFi networks without credentials, providing attackers direct wireless access to internal networks. Any organization deploying these devices faces an immediate perimeter control gap with no available patch-this is particularly critical for enterprise branch offices and remote sites relying on TOTOLINK routers for network segmentation.
No vendor-released patch identified at time of analysis. Deploy these mitigations in order of priority: (1) disable guest WiFi entirely on affected devices if the feature is not operationally required; (2) implement strict VLAN isolation between guest WiFi and production networks using 802.1Q tagging and access-control lists; (3) enable logging and alerting on the TOTOLINK management interface to detect unauthorized configuration changes; (4) restrict HTTP/HTTPS management access to guest WiFi via firewall rules; (5) conduct quarterly penetration tests of guest WiFi networks to validate isolation; (6) establish a device replacement schedule with timeline prioritized by network criticality.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB