EUVD-2026-68592
GHSA-5jq5-9vg2-x8hh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface (LAN or exposed WAN)
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke setIptvCfg without authentication
-
ExecutionOverwrite IPTV service configuration
-
ImpactDisrupt or redirect IPTV/network service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web management service (/cgi-bin/cstecgi.cgi) and the ability to send a POST invoking the setIptvCfg function; no authentication, credentials, or user interaction are needed (CVSS PR:N/UI:N). The limiting factor is reachability rather than privilege: on default home deployments the management interface is bound to the LAN, so the practical attacker must be on the local network or Wi-Fi unless remote/WAN management has been enabled, which would broaden this to fully remote internet exploitation. Impact is confined to firmware build 4.1.5cu.748_B20211015 as reported. |
| Impact | The signals partially conflict and should be weighed together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N, score 9.1) describes an easy, remote, unauthenticated attack - the kind that scores critical. Against that, EPSS is only 0.16% (6th percentile), there is no CISA KEV listing, and no public exploit code was identified, indicating no observed mass exploitation to date. The realistic exposure hinges on whether the management interface is reachable: on a home LAN the practical attacker is an on-network device, whereas WAN-exposed management would make this genuinely critical. The published C:H rating is also debatable - setIptvCfg is a configuration setter, so the concrete impact is integrity (unauthorized config change), with confidentiality gain unclear; treat C:H as unverified. Net: a real, easy-to-trigger integrity flaw in a niche consumer device, meaningful for exposed/on-path scenarios but not currently a widespread-exploitation priority. |
| Exploit ScenarioDerived | An attacker with reachability to the router's web interface - an untrusted device on the LAN/Wi-Fi, or the internet if remote management is exposed - sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking setIptvCfg with attacker-chosen values, no login required. This silently rewrites the IPTV/VLAN service configuration, enabling traffic disruption or redirection of IPTV service. No public proof-of-concept is currently identified, but the low attack complexity makes reproduction straightforward for anyone who can reach the endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite IPTV service settings by posting a crafted request to the /cgi-bin/cstecgi.cgi endpoint's setIptvCfg handler. The CGI function fails to enforce any authentication or authorization check, so anyone able to reach the web management interface can alter service configuration. No public exploit code has been identified and EPSS is low (0.16%), but the flaw is trivially reachable (CVSS 9.1, AV:N/AC:L/PR:N).
RemediationAI
No vendor-released patch version is identified at time of analysis; check the TOTOLINK download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for a firmware build superseding 4.1.5cu.748_B20211015 and apply it once published. As compensating controls, ensure remote/WAN-side web management is disabled so /cgi-bin/cstecgi.cgi is not reachable from the internet (trade-off: no remote administration), and restrict LAN access to the management interface to trusted admin hosts via ACLs or a management VLAN (trade-off: added network complexity). Given TOTOLINK's history of similar cstecgi.cgi issues, treating the entire management interface as untrusted-network-facing and segmenting the device is prudent; monitor the VulDB entry (https://vuldb.com/vuln/397352) and vendor coordination READMEs for an official fixed version.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer mesh Wi-Fi router whose web management plane is driven by a single CGI dispatcher, /cgi-bin/cstecgi.cgi, that routes JSON-style POST requests to named handler functions. This class of TOTOLINK firmware repeatedly exposes individual setter functions (here setIptvCfg, which manages IPTV/VLAN passthrough configuration) without gating them behind the session/authentication layer. The root cause is CWE-284 (Improper Access Control): the handler is invoked purely on the request-supplied function name with no verification that the caller holds an authenticated administrative session, effectively an authentication bypass for that operation. The published CPE (cpe:2.3:a:n/a:n/a) is a non-informative placeholder and does not correctly identify the product as the TOTOLINK T6 firmware.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network POST with low complexity (AV:N/AC:L/PR:N); impact is unauthorized config change so I:H, minor availability risk A:L, and no clear data disclosure so C:N rather than the published C:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain a critical unpatched vulnerability allowing remote attackers without authentication to alter IPTV service configuration. This threatens network resilience and service availability for organizations deploying these devices, with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict web management interface access to designated administrative networks via firewall rules, disable remote management if operations permit, deploy WAF rules blocking POST requests to /cgi-bin/cstecgi.cgi with setIptvCfg handler parameters, enable configuration change alerting and logging, maintain offline backups of IPTV service settings for rapid recovery.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB