EUVD-2026-68753
GHSA-qm9f-xm73-7q54
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP interface on LAN/WAN
-
ExploitCraft unauthenticated POST to /cgi-bin/cstecgi.cgi
-
ExecutionInvoke access-control-missing handler
-
ImpactWi-Fi schedule entries removed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) web management service and the ability to POST to /cgi-bin/cstecgi.cgi invoking the affected handler; no authentication, credentials, or user interaction are needed (PR:N/UI:N). The primary limiting factor is reachability: the router's management interface is typically bound to the LAN and not exposed to the WAN by default, so remote Internet exploitation depends on remote management being enabled or the device being otherwise reachable. Impact is bounded to removal of Wi-Fi schedule entries - not full configuration or credential compromise. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) captures the unauthenticated, low-complexity network reachability accurately, but the C:H/I:H/A:H impact set is overstated for the described behavior: deleting Wi-Fi schedule entries is a write/state-change with no data disclosure, so a more defensible impact is C:N/I:L/A:L. This makes the flaw a genuine unauthenticated authorization bypass but a low-impact one - nuisance-grade configuration tampering, not device takeover. Corroborating signals point the same way: EPSS is 0.18% (7th percentile), there is no KEV listing and no public PoC identified, indicating no active or widespread exploitation. Note also the description/label mismatch - the function is named 'FirmwareUpgrade' yet the stated effect is Wi-Fi schedule removal - which should be confirmed against the vendor advisory, as it may indicate either a mislabeled handler or a broader firmware-workflow issue. Realistic priority: low, gated further by the fact that most routers do not expose the management interface to the WAN by default. |
| Exploit ScenarioDerived | An attacker with network reachability to the router's web interface (an untrusted LAN client, or the Internet if remote management is enabled) sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking the vulnerable handler with no credentials. The device silently removes the configured Wi-Fi schedule entries, disabling time-based Wi-Fi controls (e.g. parental scheduling). No PoC is publicly identified, but the request is trivial to reproduce given the vendor's uniform CGI dispatch pattern. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated configuration tampering in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 lets remote attackers delete Wi-Fi schedule entries by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The affected handler (labeled 'FirmwareUpgrade' in the advisory, though the observed effect is removal of Wi-Fi schedule rules) performs no access-control check. No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile), consistent with an obscure consumer-router flaw rather than one under broad exploitation.
RemediationAI
No vendor-released patched firmware version is identified in the available data; check the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for a build newer than 4.1.5cu.748_B20211015 and apply it once published. As compensating controls, ensure the web management interface is not exposed to the WAN/Internet - disable any remote-administration option - which is the single most effective mitigation and has no functional downside for typical home users; restrict LAN-side access to the management interface and /cgi-bin/cstecgi.cgi to trusted management hosts via ACLs or a segregated VLAN, at the cost of added configuration complexity; and place the device behind a firewall that blocks inbound access to its HTTP(S) admin port. Given the low real-world impact (loss of Wi-Fi schedule rules), these network controls are sufficient interim protection until firmware is available. Monitor the coordination trackers above for fix status.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer/SOHO mesh Wi-Fi router. Like most TOTOLINK devices, its web management interface routes all administrative actions through a single CGI dispatcher, /cgi-bin/cstecgi.cgi, which selects an internal handler based on a function/topicurl field in the POST body. The root cause is CWE-284 (Improper Access Control): the handler invoked here executes its state change (removing Wi-Fi schedule entries) without verifying that the requester holds an authenticated administrative session, so any party that can reach the HTTP interface can invoke it. The CPE is a placeholder (cpe:2.3:a:n/a:n/a:*), so the exact product identity comes from the description/vendor advisory rather than a normalized NVD entry.
Know when TOTOLINK gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network POST with no interaction (AV:N/AC:L/PR:N/UI:N); effect is deletion of Wi-Fi schedule config only, so C:N and low integrity/availability (I:L/A:L), not the overstated C:H/I:H/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 router firmware contains an unauthenticated remote configuration tampering vulnerability allowing attackers to delete Wi-Fi schedule entries without authentication, affecting any organization or user relying on this device for network segmentation or scheduling controls. While the CVSS score is 9.8, the actual exploitation risk remains low (EPSS 0.2%), and no patch is currently available from the vendor.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) implement firewall rules restricting POST requests to /cgi-bin/cstecgi.cgi from untrusted networks; (2) disable remote router administration; (3) place router behind NAT/stateful firewall; (4) enable integrity monitoring on router configuration files to alert on unauthorized schedule deletions; (5) implement network segmentation to isolate router management traffic.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Rated critical severit
TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via th
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Rated critical s
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th
Exploit-DB