EUVD-2026-68585
GHSA-4wrw-r87c-p2q9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface (LAN or WAN)
-
DeliveryCraft POST to /cgi-bin/cstecgi.cgi setWanCfg
-
ExploitHandler skips auth check (CWE-284)
-
ExecutionOverwrite WAN provisioning parameters
-
ImpactRedirect or sever upstream connectivity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to send an HTTP POST to /cgi-bin/cstecgi.cgi invoking the setWanCfg handler on a TOTOLINK T6 running firmware 4.1.5cu.748_B20211015; per CVSS PR:N/UI:N no authentication, credentials, or user interaction are needed. The practical limiting factor is network reachability of the web management interface: by default this is the LAN/Wi-Fi side, so a purely remote internet attacker needs WAN-side remote management to be enabled to reach the endpoint. No non-default feature toggle is otherwise required - the missing access-control check is present in the shipped firmware. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) reflects a trivially reachable, unauthenticated network write. However, setWanCfg is a state-changing setter: its realistic impact is integrity (attacker rewrites WAN config) and availability/connectivity loss, not direct data disclosure, so the C:H rating appears overstated - an assessed vector of C:N/I:H/A:H is a closer fit. Countervailing signals lower the practical priority: EPSS is only 0.18% (7th percentile), there is no KEV listing, and no public PoC is identified, indicating low observed exploitation interest so far. That said, because exploitation is unauthenticated and low-complexity, any operator running this firmware with the management interface reachable should treat it as an urgent hardening item, since altering upstream provisioning can enable connectivity denial or man-in-the-path traffic redirection. In practice the exposure is bounded by whether the web UI is reachable from the attacker's network (typically LAN, or WAN only if remote management is enabled). |
| Exploit ScenarioDerived | An attacker with network reachability to the router (a malicious client on the LAN/Wi-Fi, or the internet if remote management is enabled) sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking setWanCfg with attacker-chosen WAN parameters, without any credentials. This rewrites the router's upstream provisioning, letting the attacker knock the network offline or redirect uplink traffic through infrastructure they control. No public exploit code is identified, but the request is simple enough to craft from the description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated WAN configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter upstream provisioning and connectivity by POSTing a crafted request to the setWanCfg handler of /cgi-bin/cstecgi.cgi, with no login required. The setWanCfg function performs no access-control check (CWE-284), so an attacker can rewrite WAN/uplink settings - potentially redirecting or severing the device's internet connectivity. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the flaw is not in CISA KEV.
RemediationAI
No vendor-released patched firmware version is identified in the provided data at time of analysis; monitor the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) and the vendor-coordination trackers for a build superseding 4.1.5cu.748_B20211015 and apply it once published. As compensating controls, disable remote/WAN-side web management so /cgi-bin/cstecgi.cgi is unreachable from the internet (trade-off: loses off-LAN administration); restrict LAN access to the management interface via client isolation or a management VLAN/ACL so untrusted wireless/guest clients cannot reach cstecgi.cgi (trade-off: added network complexity); and if the device is EOL or unfixed, replace it with a supported router. Because the endpoint lacks CSRF protection, also avoid browsing untrusted sites from an admin session on the router's network.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer/SOHO mesh Wi-Fi router. Like most TOTOLINK devices, its web management plane is served by the CGI binary cstecgi.cgi, which dispatches to named handler functions (here setWanCfg) selected by a JSON/form field in the POST body. The root cause is CWE-284 (Improper Access Control): the setWanCfg handler is reachable and executes without verifying an authenticated session or CSRF token, so a request from any network-reachable client is honored. setWanCfg governs WAN-side provisioning parameters (connection mode, PPPoE/DHCP/static uplink settings), meaning writes to it directly affect how the router obtains and routes upstream connectivity. The CPE in the feed (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not correctly identify the vendor/product; the affected component is TOTOLINK T6 firmware 4.1.5cu.748_B20211015.
Know when TOTOLINK gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated low-complexity network write to WAN config gives high integrity and availability (connectivity) impact, but a setter yields no direct confidentiality disclosure so C:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) are vulnerable to unauthenticated remote WAN configuration tampering, allowing attackers to alter internet connectivity settings without login credentials. Organizations relying on these devices for critical network access face potential service disruption, with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to /cgi-bin/cstecgi.cgi via firewall rules blocking untrusted sources; (2) Disable remote WAN-based management; isolate affected routers to trusted internal networks only; (3) Implement monitoring and alerting for unexpected WAN configuration changes; (4) Apply network-layer access controls to out-of-band management channels. No public exploit identified and exploitation likelihood is minimal (EPSS 0.2%), making network-layer isolation an effective interim control pending device replacement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Rated critical severit
TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via th
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Rated critical s
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th
Exploit-DB