EUVD-2026-68755
GHSA-j7w2-vm77-rw7v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface on LAN/WAN
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke unauthenticated delVlanCfg
-
ExecutionDelete VLAN entries
-
ImpactCollapse network segmentation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the router's web management service and the ability to reach the /cgi-bin/cstecgi.cgi endpoint that dispatches the delVlanCfg function; no authentication, credentials, or user interaction are needed (PR:N/UI:N). The practical limiting factor is reachability of the management interface: by default consumer routers expose it only on the LAN, so remote exploitation depends on either an attacker foothold on the local network or a non-default configuration with remote/WAN administration enabled. The device must be the TOTOLINK T6 running firmware 4.1.5cu.748_B20211015. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) reflects trivial network exploitability with no authentication or user interaction - a genuine concern for exposed management interfaces. However, the impact metrics look mislabeled: the described action is deleting VLAN entries, which is an integrity/availability impact (config tampering, loss of network segmentation), not a confidentiality breach, so C:H is questionable and A:N understates the disruption. Countervailing signals lower real-world priority: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing and no public POC identified, and consumer routers rarely expose their admin CGI directly to the internet by default. Net: high theoretical severity on the LAN or against misconfigured WAN-exposed devices, but low likelihood of widespread automated exploitation. Verify the confidentiality claim with the vendor - the description supports integrity/availability harm, not disclosure. |
| Exploit ScenarioDerived | An attacker with network reach to the router's management interface (a LAN foothold, or a device with remote admin exposed to the WAN) sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking delVlanCfg, with no credentials required. The request deletes VLAN entries, collapsing segmentation so that isolated segments (e.g. guest or IoT VLANs) merge with the trusted LAN, enabling lateral movement or denial of the intended isolation. No public POC has been identified, but the low attack complexity (AC:L, PR:N) makes weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Improper access control in the delVlanCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete VLAN configuration entries by POSTing to the /cgi-bin/cstecgi.cgi CGI endpoint. Removing VLAN entries collapses network segmentation, which can break isolation between trusted and guest/IoT segments and disrupt connectivity. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.
RemediationAI
No vendor-released patch identified at time of analysis; no fixed firmware version is cited in the references. As compensating controls: ensure the router's web/management interface is never reachable from the WAN (disable remote administration) so the /cgi-bin/cstecgi.cgi endpoint is only reachable from the trusted LAN; restrict LAN-side access to the admin interface to known management hosts via ACLs where the firmware allows it; and monitor TOTOLINK's download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for updated 4.1.5cu firmware and apply it once released. The trade-off of disabling remote administration is loss of off-LAN management convenience; if the T6 is deployed where network segmentation is security-critical, consider replacing it with a device that has a supported patch, since deletion of VLAN config directly undermines segmentation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The T6 is a consumer/SMB mesh Wi-Fi router whose web management plane is served by the shared cstecgi.cgi endpoint, which dispatches to named functions (here delVlanCfg) based on request parameters. The root cause is CWE-284 (Improper Access Control): the delVlanCfg function performs a state-changing VLAN-delete operation without enforcing an authentication/authorization check on the caller, so any client that can reach the CGI can invoke it. This is the same architectural weakness seen across other T6 cstecgi.cgi functions (e.g. delParentalRules and other del* handlers) where per-function auth gating is missing. The MITRE-supplied CPE 'cpe:2.3:a:n/a:n/a:*' is a placeholder and does not identify the real product.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated remote POST (AV:N/AC:L/PR:N/UI:N); deleting VLAN config tampers with configuration (I:H) and disrupts segmentation/connectivity (A:H) with no data disclosure (C:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) contain a critical vulnerability allowing unauthenticated remote attackers to delete VLAN configurations and disable network segmentation between trusted and untrusted network zones. Organizations relying on network isolation to contain breach propagation face significant risk of lateral movement and cross-segment compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Firewall ACLs blocking external access to /cgi-bin/cstecgi.cgi endpoint; (2) Enforce VLAN isolation at upstream switches independent of router configuration; (3) Deploy comprehensive logging and SOC monitoring for exploitation attempts; (4) Disable remote management on affected devices-require console-only access; (5) Deploy security appliances in front of affected routers to re-enforce network segmentation as a defense-in-depth failsafe.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB