EUVD-2026-68715
GHSA-6pjg-6x6f-cmc9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface (LAN/WAN)
-
ExploitSend crafted POST to /cgi-bin/cstecgi.cgi
-
ExecutionInvoke delParentalRules without auth
-
ImpactParental-control rules removed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web management service and the ability to POST to the /cgi-bin/cstecgi.cgi endpoint invoking the delParentalRules function; no authentication, credentials, or user interaction are needed (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is reachability of that management interface: on default home setups it is typically bound to the LAN, so an attacker must be on the local/Wi-Fi network unless WAN-side remote management has been enabled. The affected build is specifically firmware 4.1.5cu.748_B20211015 on the T6 model; other models/firmware are not confirmed vulnerable from the available data. |
| Impact | The signals are mixed. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) reflects trivial, unauthenticated, low-complexity network exploitation, and SSVC marks the flaw as automatable with total technical impact - factors that argue for prompt patching. However, EPSS is only 0.18% (7th percentile), SSVC exploitation status is 'none', it is not on CISA KEV, and no public exploit code is identified, indicating no observed real-world exploitation yet. There is also a semantic tension worth flagging: the vector claims C:H/I:H, but the described behavior is deletion of parental-control rules, which is fundamentally an integrity/availability impact on a policy feature rather than a confidentiality breach, so C:H appears overstated. In practice the honest priority is moderate: exposure depends heavily on whether the device's web interface is reachable from the untrusted side (WAN vs LAN only). For most home deployments the management interface is LAN-bound, which meaningfully limits real-world reach even though the raw CVSS is critical. |
| Exploit ScenarioDerived | An attacker able to reach the router's web interface (for example, a device on the same Wi-Fi/LAN, or the WAN side if remote management is enabled) sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking delParentalRules, with no login required. The request silently removes configured parental-control rules, disabling content/time restrictions for children's devices. No public exploit is identified yet, but the low complexity and single-request nature make weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Improper access control in the delParentalRules handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete parental-control rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The action requires no authentication (PR:N) and is automatable, though EPSS is low (0.18%) and there is no public exploit identified at time of analysis. SSVC lists exploitation as none, so this is a real but not-yet-exploited network-reachable weakness.
RemediationAI
No vendor-released patched version is identified in the provided data, so a specific fix build cannot be cited. Check the TOTOLINK download/support page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for updated T6 firmware superseding 4.1.5cu.748_B20211015 and apply it once available. As compensating controls: ensure the router's web administration interface is not exposed on the WAN side (disable any remote-management/WAN HTTP access), which prevents internet-based exploitation but does not stop an attacker already on the LAN or Wi-Fi; restrict access to the LAN management IP and the /cgi-bin/cstecgi.cgi endpoint via firewall/ACL where the platform allows, accepting that this may complicate legitimate administration; and place the device behind an upstream firewall segmenting untrusted clients (e.g., guest Wi-Fi) from the management interface, at the cost of added network configuration. Since the impact is loss of parental-control enforcement, operators relying on that feature should periodically re-verify their rules are intact.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected device is a TOTOLINK T6 consumer/SOHO wireless router whose web management interface is driven by the cstecgi.cgi CGI binary. Many TOTOLINK functions are dispatched through this single endpoint using a 'topicurl'/function-name parameter, and this class of bug arises when a privileged function is exposed without a session or authentication check. The root cause maps to CWE-284 (Improper Access Control): the delParentalRules function performs a state-changing operation (removal of parental-control policy entries) without verifying the requester's authorization. The supplied CPE 'cpe:2.3:a:n/a:n/a:*' is a placeholder and does not correctly identify the vendor/product; the real affected component is TOTOLINK T6 firmware.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated single request over the network (AV:N/AC:L/PR:N/UI:N) deletes security rules, an integrity impact (I:H); no data disclosure so C:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015 and earlier) contain a critical vulnerability allowing remote, unauthenticated attackers to disable parental control rules, completely bypassing content-filtering enforcement. Organizations and households relying on the device for access control or regulatory compliance face loss of their primary security mechanism. The vulnerability is network-accessible and requires no authentication, creating persistent organizational risk.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the router's administrative interface via firewall rules or network segmentation; deploy network-level content filtering as a secondary enforcement layer; enable comprehensive logging and real-time alerting for all router configuration changes; consider deploying a dedicated, actively-patched content-filtering appliance as a bridging control pending router replacement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB