EUVD-2026-68644
GHSA-v239-2h64-5xhw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface on LAN
-
DeliveryCraft POST to /cgi-bin/cstecgi.cgi (setWiFiMeshName)
-
ExploitHandler skips authorization check
-
ExecutionMesh entry renamed
-
ImpactConfig integrity altered
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web management endpoint /cgi-bin/cstecgi.cgi on firmware 4.1.5cu.748_B20211015 and the ability to send a crafted POST invoking the setWiFiMeshName function; no authentication, credentials, or user interaction are needed (PR:N/UI:N). The practical limiting factor is exposure: by default the interface is LAN-facing, so an attacker must be on the local network or the router must have remote/WAN administration enabled for internet-based exploitation. Impact is limited to renaming mesh entries - a configuration/integrity change, not code execution or data theft. |
| Impact | The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world impact. The unauthenticated, low-complexity, network-reachable nature (AV:N/AC:L/PR:N/UI:N) is credible for the LAN-facing management interface, but the impact metrics are inflated: setWiFiMeshName is a write-only setter that renames a mesh entry, which is an integrity effect on configuration only - it does not read secrets (no genuine C:H) and does not by itself deny service (no clear A:H). A more defensible impact is integrity-limited. Corroborating signals point to low priority: EPSS is 0.18% (7th percentile), the flaw is NOT in CISA KEV, and no POC is referenced. The 'Authentication Bypass' tag is a loose fit - this is missing authorization on a specific handler, not a bypass of the auth mechanism. Net: a real but low-severity access-control defect, most relevant where the router's web UI is exposed beyond the trusted LAN. |
| Exploit ScenarioDerived | An attacker on the same LAN (or with reach to an internet-exposed management interface) sends a single crafted POST to http://<router>/cgi-bin/cstecgi.cgi invoking setWiFiMeshName with an arbitrary name, and the router applies the rename with no authentication. This could be used to relabel mesh nodes for confusion, social-engineering (spoofing a trusted network name in the admin view), or as one step in a broader unauthenticated-config-tampering campaign against the device. No POC is referenced, and complexity is low. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiMeshName handler via a crafted POST to /cgi-bin/cstecgi.cgi with no credentials, renaming mesh network entries. The setter enforces no access control (CWE-284), so any host that can reach the web management interface can alter mesh labels. No public exploit is identified at time of analysis and EPSS is low (0.18%), consistent with a low-value config write rather than a device-takeover primitive.
RemediationAI
No vendor-released patched firmware version is identified at time of analysis; the referenced TOTOLINK pages are product/download portals rather than a versioned fix advisory, so monitor totolink.net for updated T6 firmware and apply it once published. As compensating controls: restrict access to the router's web management interface (/cgi-bin/cstecgi.cgi) to trusted management hosts only and ensure remote/WAN administration is disabled so the handler is not reachable from the internet (trade-off: none significant for home use, since WAN admin should be off by default); segment the router's LAN management VLAN away from untrusted or guest devices to limit who can reach the CGI endpoint (trade-off: added network configuration); and monitor for unexpected mesh-name changes as an indicator of tampering. Because the change is cosmetic/configuration-level, these access restrictions are the primary mitigation rather than emergency patching.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer mesh Wi-Fi router. Like most of the TOTOLINK T-series, it exposes a single CGI dispatcher at /cgi-bin/cstecgi.cgi that routes JSON/form requests to named handler functions by a 'topicurl'/function selector. The affected function, setWiFiMeshName, writes the display name of a mesh node/entry. The root cause is CWE-284 (Improper Access Control): the dispatcher invokes this setter without validating an authenticated session or CSRF token, so any request reaching the handler is honored. This is the same architectural weakness shared across the broad batch of TOTOLINK T6 cstecgi.cgi CVEs (getters that leak config and setters that mutate it without auth). The CPE 'cpe:2.3:a:n/a:n/a' is a placeholder - the real affected product is the TOTOLINK T6 firmware, not an 'n/a' vendor/product.
Know when TOTOLINK gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated LAN-reachable setter (AV:N/AC:L/PR:N/UI:N), but renaming a mesh entry is a limited integrity change with no confidentiality or availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) allow unauthenticated remote attackers to rename mesh network identifiers through an unprotected web interface. While this does not enable device takeover or data exfiltration, it represents a configuration integrity loss that could degrade network usability and user trust in WiFi naming for organizations relying on mesh deployments.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the router's web management interface via firewall ACLs, disable remote administration features, isolate affected TOTOLINK T6 devices to a trusted network segment, or replace with access-controlled mesh solutions that enforce authentication on configuration endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Rated critical severit
TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via th
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Rated critical s
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th
Exploit-DB