EUVD-2026-68673
GHSA-g2w6-f26f-58pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP interface
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke setWiFiRepeaterCfg without auth
-
ExecutionRepoint upstream Wi-Fi to attacker AP
-
ImpactIntercept and manipulate traffic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6's HTTP interface and the ability to send a POST request to the /cgi-bin/cstecgi.cgi endpoint invoking the setWiFiRepeaterCfg function on firmware 4.1.5cu.748_B20211015; per the CVSS vector (PR:N/UI:N) no authentication and no user interaction are needed. The primary limiting factor is exposure: cstecgi.cgi is typically bound to the LAN, so realistic remote exploitation depends on the management interface being WAN-exposed (remote management enabled) or the attacker already having local network access; it is also constrained to the specific T6 model and firmware build named. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N, score 9.1 Critical) describes a genuinely low-barrier attack: network vector, low complexity, no privileges, no user interaction. That severity is real for any exposed device, but the practical blast radius depends on exposure - the cstecgi.cgi interface is normally on the LAN, so remote (WAN) exploitation requires the management interface or the affected port to be internet-facing or the attacker to already be on the local network. This tension is worth verifying with the vendor. Signal-wise the picture is mixed: CVSS is Critical, yet EPSS is only 0.16% (6th percentile), there is no CISA KEV entry, and no public POC is referenced - suggesting a serious-but-not-yet-actively-exploited issue rather than a mass-exploitation event. Any operator running these routers on exposed segments should treat it as urgent and prioritize patching, while defenders relying on LAN-only exposure have more time to schedule remediation. |
| Exploit ScenarioDerived | An attacker on the same network (or with reach to an exposed management interface) sends a single crafted, unauthenticated POST request to /cgi-bin/cstecgi.cgi invoking setWiFiRepeaterCfg, reconfiguring the T6 to connect through an access point the attacker controls. All traffic the router forwards then flows through the attacker's upstream, enabling interception and manipulation. No public POC is referenced, but the low-complexity, no-auth nature makes weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Incorrect access control in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers hijack the device's Wi-Fi repeater configuration via a crafted POST to /cgi-bin/cstecgi.cgi, repointing the router to an attacker-controlled upstream access point. No public exploit or CISA KEV listing is identified at time of analysis, and the EPSS probability is low (0.16%), but the flaw is network-reachable with no authentication.
RemediationAI
No vendor-released patched firmware version is identified in the provided data at time of analysis; check the TOTOLINK download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for a firmware update newer than 4.1.5cu.748_B20211015 and apply it. Until a fix is confirmed, restrict who can reach the web/CGI interface: ensure the router's HTTP administration and cstecgi.cgi endpoint are not exposed to the WAN (disable remote management), and on the LAN limit access to a management VLAN or trusted hosts via firewall/ACL rules - the trade-off is that legitimate remote administration and app-based management will stop working. As a detective control, monitor for unexpected changes to the Wi-Fi repeater/upstream configuration and for unauthenticated POSTs to /cgi-bin/cstecgi.cgi. Cross-check the vendor coordination README (https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md) for the latest fix status.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the setWiFiRepeaterCfg handler inside cstecgi.cgi, the monolithic CGI backend that TOTOLINK routers use to process web/administrative API calls. The root cause is CWE-284 (Improper Access Control): the endpoint fails to enforce an authentication/authorization check before accepting configuration changes, so a repeater-mode setting that should require an authenticated admin session is instead writable by any client that can reach the HTTP interface. Because the repeater/upstream Wi-Fi setting governs which access point the device connects through, controlling it effectively lets an attacker insert themselves upstream of all client traffic.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network POST with no interaction (PR:N/UI:N/AC:L); hijacking the upstream enables traffic interception and redirection (C:H/I:H), with no direct availability loss (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) contains an unauthenticated remote access control flaw allowing attackers to hijack Wi-Fi repeater configuration and redirect network traffic through attacker-controlled access points. Organizations deploying this model face risk of network interception and credential compromise. No vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: network segmentation and access restrictions isolating affected devices, disable UPnP and remote management interfaces, disable repeater mode if not operationally required, and implement monitoring for unauthorized configuration changes or anomalous outbound traffic patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB