EUVD-2026-68640
GHSA-rcw5-25cw-v2gc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
ExploitSend crafted POST to /cgi-bin/cstecgi.cgi
-
ExecutionInvoke setParentalRules without auth
-
ImpactAlter or disable parental-control rules
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's HTTP management endpoint /cgi-bin/cstecgi.cgi and the ability to send a POST request invoking the setParentalRules function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015; per CVSS PR:N/UI:N no authentication or user interaction is needed. The principal limiting factor is exposure of the management interface: by default consumer routers expose it only to the LAN, so remote (WAN) exploitation depends on remote administration being enabled or the interface otherwise being internet-reachable. Impact is also bounded to the parental-control feature as described, not confirmed full device compromise. |
| Impact | The input CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), which reflects network-reachable, low-complexity, unauthenticated access - genuinely easy to trigger. However, the C:H/I:H rating appears inflated relative to the description, which limits the concrete impact to altering parental-control behavior; that is primarily an integrity effect on one feature, with no described confidentiality exposure, so real-world severity is likely lower than the headline score suggests (verify the true impact scope with the vendor). No EPSS score, no POC, and no KEV listing were provided, so there is no evidence of active or imminent widespread exploitation despite the high CVSS. On balance this is a real but bounded issue: trivially exploitable if the management interface is exposed, yet the practical damage is constrained to parental controls unless a broader access-control weakness exists in cstecgi.cgi. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface (for example over the LAN, or over the WAN if remote management is enabled) sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking setParentalRules, with no credentials required. This lets them disable or rewrite parental-control rules - for instance a household member bypassing time or content restrictions. No public exploit code was identified, but the low attack complexity means a working request is straightforward to construct. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Improper access control in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers modify parental-control settings by sending a crafted POST request to the setParentalRules handler at /cgi-bin/cstecgi.cgi. The flaw requires no authentication and no user interaction, so anyone able to reach the device's web interface can alter or disable parental restrictions. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
RemediationAI
No vendor-released patched firmware version is identified in the provided data; consult the TOTOLINK firmware download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for a build newer than 4.1.5cu.748_B20211015 and apply it once available. As compensating controls, ensure the router's web management interface (/cgi-bin/cstecgi.cgi) is not exposed to the WAN - disable remote/WAN administration, which prevents internet-based exploitation at the cost of losing off-LAN management. Restrict LAN-side access to the admin interface via management VLAN or firewall rules so untrusted local hosts cannot reach cstecgi.cgi, accepting the trade-off of more complex network setup. Treat parental-control configuration as untrustworthy until patched, since it can be altered without authentication.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the CGI-based web management interface (cstecgi.cgi) common to TOTOLINK consumer/SOHO routers, which dispatches administrative actions to internal handler functions such as setParentalRules. The root cause is CWE-284 (Improper Access Control): the setParentalRules endpoint fails to enforce an authentication/authorization check before processing state-changing requests, so the security-sensitive operation is reachable by any caller. The supplied CPE ('cpe:2.3:a:n/a:n/a:*') and EUVD affected-version string ('n/a n/a') carry no usable product/version data, so the concrete affected scope rests on the description's named firmware build rather than structured metadata.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network access with low complexity (PR:N/AC:L), but described impact is limited to altering the parental-control feature, so C:N and I:L rather than the input's C:H/I:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) are vulnerable to complete bypass of parental-control restrictions through unauthenticated remote access. An attacker can disable or modify content filtering settings without credentials, undermining organizational or family-based internet access policies. This affects any entity relying on these devices for content governance, particularly enterprises managing employee networks and households protecting minor users.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the router's web interface through firewall rules (block inbound access except from administrative networks), segment affected devices to isolated networks to prevent lateral movement, disable remote management features if available, continuously monitor TOTOLINK security advisories for firmware updates, and establish a device replacement timeline if no patch is released within your organization's established SLA for critical vulnerabilities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB