EUVD-2026-68674
GHSA-xc9w-qf3x-rv82
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface (LAN or exposed WAN)
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke setPairCfg without authentication
-
ExecutionAlter mesh pairing state
-
ImpactRogue node join or pairing disruption
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the router's HTTP management endpoint /cgi-bin/cstecgi.cgi and send a crafted POST invoking the setPairCfg function; no authentication, user interaction, or non-default setting is needed on the device itself (PR:N/UI:N). The practical limiting factor is network reachability of the management interface: in a default home deployment this is LAN-side only, so a remote internet-based attacker succeeds only if remote/WAN administration is enabled or the web UI is otherwise exposed to the WAN. The affected build must be 4.1.5cu.748_B20211015 (TOTOLINK T6). |
| Impact | Signals partly agree and partly conflict. The supplied CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects trivial, unauthenticated, low-complexity network access to an administrative function - genuinely severe on paper. Against that, EPSS is only 0.16% (6th percentile), there is no CISA KEV listing and no public exploit identified, indicating no observed real-world exploitation. I also consider the C:H/I:H rating optimistic for the described impact: altering mesh pairing state is primarily an integrity/availability concern, and confidentiality-high is not clearly justified by the description alone, so the 9.1 is likely inflated. Practically, exposure hinges on whether the management interface (cstecgi.cgi) is reachable - LAN-only in most home deployments, but internet-facing if remote administration is enabled or the WAN interface exposes the web UI. Net: a real, easily-triggered access-control defect on a low-footprint consumer device, deserving patching but not emergency prioritization absent WAN exposure. |
| Exploit ScenarioDerived | An attacker with network reach to the router's web interface - a malicious device on the LAN, or the internet if remote management/WAN exposure is enabled - sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking the setPairCfg function, without supplying any credentials. This alters the mesh pairing configuration, potentially letting the attacker join a rogue node to the mesh or disrupt legitimate pairing. No public proof-of-concept is currently identified, though the low attack complexity makes one straightforward to develop. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated tampering with mesh Wi-Fi pairing on the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers manipulate the device's mesh pairing state by posting to the setPairCfg handler of the cstecgi.cgi endpoint, with no credentials required. The flaw is an access-control gap (CWE-284) reported by MITRE; no public exploit code or active exploitation is currently identified, and EPSS is low (0.16%, 6th percentile), so risk is elevated by the trivial preconditions but not by observed attacker interest.
RemediationAI
No vendor-released patched firmware version is identified in the available data (no fixed build number is cited), so treat this as 'No vendor-released patch identified at time of analysis' and monitor the TOTOLINK T6 download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for a firmware release superseding 4.1.5cu.748_B20211015. As compensating controls: disable remote/WAN management of the web interface so /cgi-bin/cstecgi.cgi is not reachable from the internet (trade-off: administration must be done from the LAN); restrict access to the management interface to a trusted management VLAN or specific admin hosts via firewall/ACL (trade-off: adds network configuration overhead); and if the device supports it, place the router behind an upstream firewall that blocks inbound access to the HTTP management port. Because the flaw is unauthenticated, changing the admin password does not mitigate it. Coordination status is tracked at the referenced GitHub CVE-Vendor-Coordination repositories.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer/SOHO mesh Wi-Fi router whose web management interface is driven by the CGI binary at /cgi-bin/cstecgi.cgi, a common TOTOLINK architecture where a single CGI dispatches to named handler functions selected by the request body. Here the setPairCfg function, which governs mesh node pairing configuration, fails to enforce an authentication/authorization check before acting on requests. This is a textbook CWE-284 Improper Access Control: a state-changing administrative function is reachable by any client that can send it a request, rather than being gated behind a valid session. The affected version is explicitly the 4.1.5cu.748_B20211015 firmware build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network POST (AV:N/AC:L/PR:N/UI:N) tampers with mesh pairing config, so I:H; no data disclosure implied (C:N) and pairing disruption gives A:L, not A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
The TOTOLINK T6 mesh Wi-Fi router (firmware 4.1.5cu.748_B20211015 and earlier) contains a critical access-control vulnerability (CWE-284) permitting unauthenticated remote attackers to manipulate mesh pairing state, enabling unauthorized device connections and potential network infiltration. Organizations operating TOTOLINK T6 systems face immediate topology compromise risk with no vendor patch available, requiring urgent inventory and network isolation efforts.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict network access to cstecgi.cgi endpoint via firewall ingress rules to block POST operations; (2) disable mesh networking features if not operationally required, eliminating attack surface; (3) implement network segmentation to isolate affected TOTOLINK T6 routers from critical systems, administrative networks, and user segments to contain lateral movement; (4) establish monitoring for TOTOLINK firmware releases and CVE advisories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB