EUVD-2026-68672
GHSA-44cj-pjqf-756c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web endpoint /cgi-bin/cstecgi.cgi
-
DeliverySend crafted POST to UploadCustomModule
-
ExploitBypass absent access control
-
ExecutionInstall attacker CGI module
-
PersistWeb server executes module as root
-
ImpactPersistent RCE and network pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability of the device's web management endpoint /cgi-bin/cstecgi.cgi and the ability to send a POST invoking the UploadCustomModule function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 - no authentication, credentials, or user interaction are needed (PR:N/UI:N). The primary limiting factor is exposure: if HTTP management is bound to the LAN only (the default for many home routers), the attacker must already be on the local/guest network rather than fully remote across the internet; devices with remote/WAN management enabled are directly exploitable from the internet. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H) describes a trivially reachable, unauthenticated, low-complexity flaw - the worst end of the spectrum for reachability. Against that, EPSS is only 0.16% (6th percentile), there is no KEV listing, and no POC is referenced, so real-world exploitation appears speculative/targeted rather than widespread today. Note a signal conflict: the provided vector sets A:N, but installing an arbitrary CGI module yields code execution, which normally implies availability impact as well - the A:N understates impact, and this is arguably better modeled as full compromise (C:H/I:H/A:H). SSVC-style read: exploitation=none observed, automatable=yes (network, no auth, scriptable single request), technical impact=total. For internet-exposed T6 devices this is a genuine high priority; for LAN-only devices the practical risk drops to malicious/compromised local clients. Treat the 9.1 score as directionally correct but verify the availability metric and the 'Authentication Bypass' framing against the vendor description. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface - over the internet if remote management is on, otherwise from any host on the LAN or guest network - sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking UploadCustomModule with a malicious CGI payload. The module is installed and executed by the web server as root, giving the attacker a persistent backdoor, traffic interception, and a foothold to pivot into the internal network. No credentials, user interaction, or exploit chaining is required; no public POC is currently referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated custom-CGI-module installation on the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers plant attacker-controlled CGI code through the UploadCustomModule handler in /cgi-bin/cstecgi.cgi. Because the endpoint enforces no authentication or access control, a single crafted POST request installs an executable module - effectively arbitrary code execution on the device. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile), indicating no observed mass exploitation yet.
RemediationAI
No vendor-released patch version is identified at time of analysis; the referenced TOTOLINK pages are the product/download portal, so monitor them and the vendor-coordination trackers (github.com/DarkBoulder/CVE-Vendor-Coordination and github.com/ShengWu00/CVE-Vendor-Coordination) for a fixed firmware build and upgrade as soon as one is published. Until then, apply compensating controls: disable remote/WAN management so /cgi-bin/cstecgi.cgi is not reachable from the internet (trade-off: no off-LAN administration); restrict management access to a trusted management VLAN or specific admin hosts via ACLs (trade-off: added network config); block inbound access to the HTTP management port from untrusted segments at an upstream firewall; and, for high-risk deployments, retire or replace the device given it is an end-of-support-era consumer build. Verify device integrity afterward, since a successful attack persists as an installed CGI module and a firmware factory-reset/reflash may be required to remove implanted code.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The T6 is a consumer mesh/router whose web management backend is driven by a single CGI dispatcher, cstecgi.cgi, that routes requests to named functions by a 'topicurl'/function parameter. UploadCustomModule is intended as a privileged provisioning/extension path for installing add-on CGI modules. The root cause is CWE-284 (Improper Access Control): the dispatcher invokes this sensitive function without verifying a session, token, or role, so any network client can reach it. Installing a custom CGI module means the attacker's code is dropped into the CGI execution path and run by the web server, which typically runs as root on these SoC-based devices. The affected product is TOTOLINK T6 firmware 4.1.5cu.748_B20211015; the CPE 'cpe:2.3:a:n/a:n/a' is a non-informative MITRE placeholder rather than a real product identifier.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated single-request install of an attacker CGI module is full code execution, so C:H/I:H/A:H; I raise A from the input's N since arbitrary root code affects availability too.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
The TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 and likely other versions) contains an unauthenticated remote code execution vulnerability allowing attackers to install malicious CGI modules with a single HTTP request, gaining complete control of the device. This directly compromises organizational network infrastructure, enabling attackers to intercept all traffic, modify routing configurations, and establish persistent backdoors.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) implement strict inbound firewall rules blocking external HTTP POST requests to the UploadCustomModule endpoint on /cgi-bin/cstecgi.cgi; (2) segment routers into isolated VLANs to prevent compromised devices from pivoting to critical systems; (3) enable NetFlow or similar monitoring to detect anomalous CGI upload traffic patterns; (4) restrict LAN-side access to the web interface through hardened jump-host architecture. These controls reduce but do not eliminate risk for LAN-based or supply-chain-based attackers; device replacement is strongly recommended.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB