EUVD-2026-68587
GHSA-2x6c-v7m7-w2w9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface on LAN or WAN
-
DeliveryCraft unauthenticated POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke setWiFiGuestCfg with attacker values
-
ExecutionGuest WiFi enabled or encryption weakened
-
ImpactRogue-network foothold for interception/pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web management endpoint /cgi-bin/cstecgi.cgi on firmware 4.1.5cu.748_B20211015, and the ability to send a POST invoking the setWiFiGuestCfg function - no authentication, user interaction, or non-default configuration is needed (PR:N/UI:N). The practical limiting factor is reachability: by default the management interface is LAN-facing, so an attacker must be on the LAN/guest wireless segment unless the owner has exposed the UI to the WAN; the impact is confined to guest-WiFi configuration state on that single device. |
| Impact | The published CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) captures the trivial, unauthenticated, network-reachable nature of the flaw, but the C:H (confidentiality-High) rating is overstated: setWiFiGuestCfg is a write-only configuration setter, so the direct impact is integrity (attacker alters guest-WiFi state), not bulk data disclosure - I reassess this closer to 7.5 with C:N/I:H. EPSS is low at 0.16% (6th percentile) and there is no CISA KEV listing and no public exploit code, so this is not evidence of active or widespread exploitation; the low EPSS reflects a niche SOHO product and no weaponized PoC rather than a mitigating design factor. That said, the precondition bar is essentially zero on an exposed device, so any operator whose T6 management interface is reachable from an untrusted segment should treat it as urgent regardless of the low probability score. Net: real integrity risk with easy exploitation, but limited blast radius per device and modest population-level urgency. |
| Exploit ScenarioDerived | An attacker who can reach the router's management interface - for example on the same guest/LAN segment, or across the internet if the web UI is WAN-exposed - sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking setWiFiGuestCfg with no credentials, enabling an open guest SSID or stripping its encryption/isolation. Clients then join the attacker-influenced guest network, giving the attacker a foothold to intercept or pivot. No public PoC is identified, but the request is simple enough to reproduce from the description alone. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Missing authorization in the setWiFiGuestCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers create or weaken the guest wireless network by POSTing a crafted request to /cgi-bin/cstecgi.cgi. Because the setter applies configuration without any session or credential check, an attacker can stand up an open/weakly-secured guest SSID or downgrade guest isolation without ever authenticating. No public exploit is identified at time of analysis and EPSS is low (0.16%), but exploitation is trivial against the affected build.
RemediationAI
No vendor-released patched firmware version is identified in the provided data at time of analysis, so track the TOTOLINK T6 download page (https://www.totolink.net/) and apply any firmware newer than 4.1.5cu.748_B20211015 once published. As compensating controls: ensure the router's HTTP management interface (and cstecgi.cgi) is never exposed to the WAN or to untrusted LAN/guest segments - bind administration to a trusted management VLAN or wired LAN only (side effect: remote/app-based management from the guest network breaks); place the device behind an upstream firewall that blocks inbound access to the web UI port; and if the guest-WiFi feature is not needed, disable it entirely to reduce the exposed configuration surface (side effect: loss of a legitimate guest network). Given TOTOLINK's history and the absence of a confirmed fix, end-of-support or unpatchable units should be considered for replacement.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TOTOLINK T6 is a consumer/SOHO mesh Wi-Fi router. Like most TOTOLINK devices, its web management plane is served by cstecgi.cgi, a CGI binary that dispatches JSON-style POST commands to internal handlers by a 'topicurl'/function name. The setWiFiGuestCfg function writes guest-WiFi parameters (SSID enablement, encryption/isolation settings) but does not verify that the caller holds an authenticated administrative session, which is the CWE-284 (Improper Access Control) root cause - an authorization check that is simply absent on a state-changing endpoint. The CPE in the feed (cpe:2.3:a:n/a:n/a:*) is a placeholder; the real affected product is the TOTOLINK T6 router firmware, and this is device firmware rather than the generic application indicated by the 'a' part.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated, low-complexity network POST with no user interaction; setWiFiGuestCfg is a write-only setter so integrity is High but there is no data-read (C:N) and no direct availability loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
Unauthenticated attackers can remotely reconfigure guest WiFi settings on vulnerable TOTOLINK T6 routers without credentials, potentially creating security risks for guest devices and undermining network isolation. No vendor patch is currently available, and no public exploit has been identified at time of analysis. Organizations should immediately identify affected equipment and implement network controls to prevent unauthorized configuration changes.
No vendor-released patch identified at time of analysis. Interim mitigations: disable guest WiFi if unused; implement network segmentation to isolate the guest network from critical infrastructure; monitor router administrative logs for unauthorized configuration changes; restrict administrative access to authorized personnel only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB