EUVD-2026-68651
GHSA-2pmg-2pg7-55cv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP interface
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke setDmzCfg without authentication
-
ExecutionAssign internal host to DMZ
-
ImpactInternal host exposed to inbound attacks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the router's HTTP interface exposing /cgi-bin/cstecgi.cgi to be network-reachable by the attacker and the setDmzCfg action to be callable - per CVSS PR:N no authentication is needed and per UI:N no user interaction is required, so exploitation works against default configurations of the TOTOLINK T6 on firmware 4.1.5cu.748_B20211015. The practical limiting factor is reachability: on typical deployments the management interface is LAN-only, so internet exploitation depends on remote/WAN management being enabled; the impact (exposing an internal host via DMZ) also presupposes there is a valuable internal host behind the router worth exposing. |
| Impact | Signals conflict and should be weighed rather than taken at face value. The input CVSS is 9.8 with AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H, which reflects an unauthenticated, low-complexity network flaw - but the described impact is narrower than 'total compromise': the attacker changes DMZ configuration to expose an internal host, which is primarily an integrity/exposure impact rather than direct high confidentiality and availability loss on the router itself, so the CIA-all-High rating appears inflated for the stated behavior. Countervailing signals point to lower urgency: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit was identified. The realistic risk is that this is a genuine unauthenticated access-control bug on a consumer router but one that today looks like a latent exposure/pivot enabler rather than an actively exploited, wormable RCE. Exploitation still requires network reachability of the router's HTTP interface, which on most deployments is LAN-side unless remote management is enabled. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface - trivially from the LAN, or from the internet if remote management is enabled - sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking setDmzCfg with no credentials, designating a chosen internal host as the DMZ target. That host is then fully exposed to inbound traffic, letting the attacker directly scan and attack an otherwise NAT-protected internal device. No public proof-of-concept is identified, but the low attack complexity makes the request straightforward to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthorized DMZ reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote, unauthenticated attacker reach the setDmzCfg handler exposed by /cgi-bin/cstecgi.cgi and place an internal LAN host into the router's DMZ, making that host directly reachable from the internet. The flaw stems from a missing authentication/authorization check (CWE-284) on a state-changing configuration function. No public exploit or active exploitation is recorded, and EPSS is low (0.18%, 7th percentile), so this is a high-CVSS device flaw without evidence of widespread exploitation to date.
RemediationAI
No vendor-released patched firmware version is independently confirmed from the provided data; the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) is referenced, so check it for a firmware build later than 4.1.5cu.748_B20211015 and apply it if available. Until a fixed build is confirmed, the highest-value compensating control is to disable remote/WAN management of the web interface so /cgi-bin/cstecgi.cgi is not reachable from the internet (trade-off: loss of remote administration convenience). Additionally, restrict access to the router's HTTP management interface to trusted LAN hosts or a management VLAN and block inbound WAN access to the management port (trade-off: administrators must be on-network). Operators should also audit the current DMZ configuration for unexpected internal-host entries, since an exploited device may already have a rogue DMZ host set. Avoid relying on the vendor CPE/EUVD metadata for scoping given its 'n/a' placeholders.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is TOTOLINK's cstecgi.cgi, the monolithic CGI endpoint used across many TOTOLINK SOHO routers to dispatch configuration actions by function name in a POST body (here the setDmzCfg action, which controls the DMZ / exposed-host feature). The root cause is CWE-284 Improper Access Control: the handler acts on the request without verifying that the caller is an authenticated administrator, so any client that can reach the web interface can invoke a privileged configuration change. DMZ functionality forwards all inbound traffic for the WAN address to a designated internal host, so an unauthorized write to this setting directly changes the network exposure of a device behind the router. Note that the supplied CPE (cpe:2.3:a:n/a:n/a:*) carries placeholder 'n/a' vendor and product values and does not correctly identify the affected product.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated low-complexity network write to DMZ config gives I:H; exposing a separate internal host is a scope change with indirect C:L; no direct availability impact, so A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015 and potentially other versions) contain a critical flaw allowing remote, unauthenticated attackers to reconfigure DMZ settings and expose internal network hosts directly to the internet. No vendor patch is currently available, creating sustained network perimeter risk for any organization deploying this device.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or restrict access to /cgi-bin/cstecgi.cgi handler via firewall rules where operationally feasible; implement strict network segmentation so DMZ-reachable hosts are isolated from sensitive systems; enable detailed router configuration logging and alerting on setDmzCfg changes; restrict administrative access to the router to trusted networks only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB