EUVD-2026-68713
GHSA-cf72-3m5m-4j66
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach T6 web management interface
-
DeliveryCraft malicious firmware image
-
ExploitPOST to UploadFirmwareFile at cstecgi.cgi
-
ExecutionDevice flashes attacker firmware
-
ImpactPersistent root control / device takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reachability of the TOTOLINK T6 HTTP management interface and the ability to send a POST request to the UploadFirmwareFile action of /cgi-bin/cstecgi.cgi; no authentication, credentials, or user interaction are needed (PR:N/UI:N). The primary limiting factor is network exposure: on default SOHO deployments the interface is LAN-facing and NAT-protected, so an internet-based attacker must first reach the device (WAN-exposed management, an on-LAN foothold, or CSRF-style pivoting). The vulnerability is specific to firmware build 4.1.5cu.748_B20211015; other builds are unconfirmed. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) is well-matched to this vulnerability class: unauthenticated firmware replacement genuinely delivers full confidentiality, integrity, and availability loss, unlike the read-only TOTOLINK getter CVEs where C:H is overstated. Countering the high CVSS, EPSS is only 0.16% (6th percentile), there is no CISA KEV listing and no public PoC identified, indicating no observed mass exploitation to date. SSVC-style reasoning still weights this heavily: technical impact is total and the action is automatable against exposed devices, so any operator - even a mid-sized municipal IT team in boleslawiec - should treat an internet-exposed T6 management interface as urgent. The dominant real-world caveat is exposure: consumer/SOHO routers are usually NAT'd, so remote reachability of the LAN-side web interface is the practical gating factor. |
| Exploit ScenarioDerived | An attacker who can reach the router's management interface sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking UploadFirmwareFile with a malicious firmware image, requiring no credentials or user interaction. The device flashes the attacker's firmware, giving the attacker persistent root-level control to intercept traffic, pivot into the LAN, or enroll the router into a botnet. No public PoC is identified, but the low attack complexity makes weaponization straightforward if the interface is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated firmware upload in TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) lets remote attackers push a crafted firmware image via the UploadFirmwareFile handler in /cgi-bin/cstecgi.cgi without any credentials. Because the device applies attacker-supplied firmware, this is effectively a full-device-takeover primitive yielding persistent code execution. No public exploit is identified at time of analysis; EPSS is low (0.16%, 6th percentile) despite the 9.8 CVSS.
RemediationAI
No vendor-released fixed firmware version is identified at time of analysis; monitor the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for an updated T6 build and apply it once published. As compensating controls: ensure the device's web/CGI management interface is never exposed to the WAN/internet (block inbound TCP 80/443/8080 to the router and disable any remote-management option), which prevents the remote vector at the cost of losing off-LAN administration; segment the router's LAN-side management to a trusted VLAN/management host to limit who can reach /cgi-bin/cstecgi.cgi, accepting added network-configuration overhead; and consider retiring/replacing end-of-support T6 hardware if no patched firmware appears, since firmware-upload flaws cannot be reliably mitigated in place. Validate firmware integrity out-of-band if compromise is suspected, as a successful attack can persist across reboots.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the CGI backend cstecgi.cgi common to TOTOLINK SOHO routers, which dispatches management actions by function name in POST bodies. The root cause is CWE-284 (Improper Access Control): the UploadFirmwareFile action performs no authentication or session check before accepting and processing an uploaded firmware image. Firmware upload is the highest-privilege operation on such devices, so an access-control gap here allows an attacker to replace the running firmware - bypassing the read/write distinction entirely and enabling arbitrary code execution and persistence at the device level. The provided CPE (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not identify the real product, which is the TOTOLINK T6 router (hardware/firmware, not a generic application).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated single-request firmware upload yields full code execution and persistence, so C/I/A all High with no privileges or interaction; network vector gated only by interface reachability.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upload a crafted firmware image via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers are vulnerable to unauthenticated remote firmware upload, allowing attackers to completely seize device control and establish persistent network presence. Although no public exploit has been identified at time of analysis, the absence of vendor patches leaves affected organizations indefinitely exposed to this critical attack vector. This vulnerability creates direct risk for data exfiltration, lateral movement into internal networks, and long-term adversary persistence.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Network segmentation isolating TOTOLINK T6 routers to dedicated VLANs with minimal trust from internal systems; (2) Restrict remote management access through IP allowlists or VPN-only mechanisms; (3) Implement firmware integrity monitoring and real-time alerting for unauthorized device changes; (4) Deploy network-based intrusion detection focused on anomalous device-initiated outbound connections; (5) Expedite replacement with alternative routers receiving active vendor security support, prioritizing internet-facing or security-critical network segments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB