EUVD-2026-68588
GHSA-4pvw-j7mm-g95w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP interface
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke setVpnPassCfg without authentication
-
ExecutionModify VPN/edge-filtering configuration
-
ImpactWeaken perimeter to expose internal network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the router's HTTP management interface and the ability to POST to /cgi-bin/cstecgi.cgi invoking the setVpnPassCfg function; per CVSS PR:N/UI:N no authentication or user interaction is needed. The concrete limiting factor is exposure of that management interface: on a default deployment where the web UI is bound only to the LAN, an attacker must already be on the local network (or the WAN-side admin interface must be enabled) to reach the endpoint. Exploitation is further constrained to the specific affected build, TOTOLINK T6 firmware 4.1.5cu.748_B20211015. |
| Impact | Signals conflict and should be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) rates this Critical, and the unauthenticated/network/low-complexity metrics are consistent with the description. However, the C:H/I:H/A:H impact triad appears inflated relative to the described effect: the CVE only states that an attacker can 'weaken edge filtering,' which is an unauthorized configuration change (integrity impact) rather than confirmed data disclosure or denial of service - verify the full impact with the vendor before treating this as full compromise. Counterbalancing the high CVSS, EPSS is very low (0.16%, 6th percentile), there is no CISA KEV listing and no public PoC, indicating no observed or imminent mass exploitation. Net: a genuine unauthenticated flaw worth patching on exposed devices, but real-world urgency is moderate - the practical value to an attacker is as a filtering-bypass stepping stone rather than direct device takeover. |
| Exploit ScenarioDerived | An attacker who can reach the router's HTTP management interface sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking setVpnPassCfg with no credentials, altering the VPN pass-through / edge-filtering configuration. With perimeter filtering weakened, the attacker can then more freely probe or reach services on the internal network behind the router. No public PoC is currently identified, but the low attack complexity means a working request would be trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers reconfigure the device's VPN pass-through / edge-filtering settings by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which fails to authenticate calls to the setVpnPassCfg function. Successful exploitation weakens the router's perimeter filtering, degrading the security posture protecting devices behind it. No public exploit code has been identified and the CVE is not on CISA KEV; EPSS is low at 0.16% (6th percentile).
RemediationAI
No exact vendor-released fix version is identified in the available data at time of analysis; check the TOTOLINK firmware download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html and https://www.totolink.net/) for a firmware build newer than 4.1.5cu.748_B20211015 for the T6 and flash it once available. As compensating controls until a patched build is confirmed: ensure the router's web/administration interface is not reachable from the WAN/Internet (disable any remote-management option), which prevents remote reach to /cgi-bin/cstecgi.cgi at the cost of losing remote admin convenience; place the device behind an upstream firewall and restrict access to the management interface to a trusted management VLAN or specific LAN hosts; and do not rely on the router's own edge filtering as your sole perimeter control, since that is precisely the function this flaw weakens. Review coordination status at https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the TOTOLINK T6 mesh/Wi-Fi router firmware, whose web management interface is driven by the CGI binary /cgi-bin/cstecgi.cgi - a single dispatcher that routes JSON-style POST bodies to named handler functions. The vulnerable handler, setVpnPassCfg, applies VPN pass-through and edge-filtering configuration but does not enforce an authenticated session before acting, which is the CWE-284 (Improper Access Control) root cause: a privileged state-changing operation is reachable without the authorization check that should gate it. This mirrors a long-standing pattern in TOTOLINK cstecgi.cgi handlers where individual command functions omit session validation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated low-complexity POST reaches the handler (PR:N/AC:L/AV:N), but the described effect is unauthorized modification of filtering config, so I:H with no direct confidentiality or availability loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) contain a critical unauthenticated vulnerability allowing remote attackers to disable VPN pass-through and edge-filtering, effectively removing perimeter defenses protecting the entire network. No public exploit identified at time of analysis, but the vulnerability's ease and criticality (CVSS 9.8) create immediate risk of network-wide exposure. Organizations must identify and contain affected routers within 24 hours, with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict network access to /cgi-bin/cstecgi.cgi to trusted administrative sources via firewall rules, (2) implement IPS/WAF rules to block POST requests to the vulnerable setVpnPassCfg function, (3) disable VPN pass-through feature entirely if not operationally required, (4) network segmentation to isolate routers from direct internet exposure, (5) enhanced logging and alerting on access attempts to this endpoint to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB