EUVD-2026-68750
GHSA-qpcx-vj6v-x66f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke clearSyslog without auth
-
ExecutionErase system logs
-
ImpactDestroy forensic audit trail
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web management service and the ability to POST to the clearSyslog function at /cgi-bin/cstecgi.cgi; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are needed against the affected firmware 4.1.5cu.748_B20211015. The primary limiting factor is exposure of the HTTP management interface: by default this is LAN-only, so internet-wide exploitation depends on remote administration being enabled or the management port being otherwise forwarded/exposed. Impact is also bounded - the function erases system logs (an anti-forensics/integrity effect) rather than granting code execution or data disclosure. |
| Impact | The input CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) rates this as critical, but the impact metrics look overstated for the described behavior: clearSyslog erases logs, which is an integrity/anti-forensics impact on the audit trail - it does not disclose data, so C:H is hard to justify. The exploitation signals are modest and mutually consistent: EPSS is 0.18% (7th percentile), SSVC records Exploitation=none with no KEV listing and no POC, indicating no observed real-world use. However, SSVC also flags Automatable=yes and Technical Impact=total, and the CVSS vector (network, low complexity, no privileges, no user interaction) means the request itself is trivial to script against exposed devices. The realistic danger is not data theft but destruction of forensic evidence - an attacker can silently erase logs to cover other activity - so the true priority is lower than a 9.1 suggests in isolation but non-trivial for internet-exposed units, and any operator running affected T6 devices should schedule remediation rather than dismiss it as a paper-critical finding. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface - for example a device with remote management left enabled on the WAN, or a foothold on the local network - sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking clearSyslog, no login required. The device wipes its system logs, destroying evidence of prior or concurrent malicious activity. No public POC is identified, but the request is simple and, per SSVC, automatable across many devices. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated log erasure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers wipe system logs by sending a crafted POST request to the clearSyslog handler at /cgi-bin/cstecgi.cgi, with no credentials required. The flaw is an incorrect-access-control (CWE-284) gap on an administrative maintenance function that should be privileged. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.18% (7th percentile), consistent with a niche consumer-router target rather than mass exploitation.
RemediationAI
No vendor-released patched firmware version is identified at time of analysis; the referenced TOTOLINK pages are the download/product portal rather than a specific fixed build, so monitor them for an update newer than 4.1.5cu.748_B20211015 and apply it once published. In the interim, apply specific compensating controls: ensure the router's web management interface (HTTP/HTTPS on /cgi-bin/cstecgi.cgi) is not reachable from the WAN/internet - disable remote administration in the device settings, which prevents external exploitation at the cost of losing remote management convenience. On the LAN side, restrict access to the management interface to a trusted management VLAN or specific admin hosts via firewall/ACL, accepting that this complicates legitimate admin from other subnets. Because the impact is log erasure, forward device syslog to an external collector or SIEM so that a local wipe cannot destroy the only copy of the audit trail. Refer to https://nvd.nist.gov/vuln/detail/CVE-2026-51736 and the vendor site for advisory updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the TOTOLINK T6, a consumer/SOHO mesh Wi-Fi router. Like most TOTOLINK devices, it exposes its web management logic through a single CGI dispatcher, /cgi-bin/cstecgi.cgi, which routes JSON/form POST bodies to named backend functions - here the clearSyslog routine that purges the device's syslog. The root cause is CWE-284 (Improper Access Control): the dispatcher invokes clearSyslog without verifying that the caller holds an authenticated administrative session, so a request that should require login is honored anonymously. This mirrors a recurring pattern across TOTOLINK T6 cstecgi.cgi endpoints where individual command handlers omit session checks. The supplied CPE (cpe:2.3:a:n/a:n/a:*) is an unusable placeholder; the real affected product is TOTOLINK T6 firmware 4.1.5cu.748_B20211015.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network request (AV:N/AC:L/PR:N/UI:N) that only erases logs - an audit-trail integrity impact (I:L), with no confidentiality or availability effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers contain a critical access control flaw allowing unauthenticated remote attackers to delete system logs via crafted POST requests, with no public exploit identified at time of analysis. Organizations lose the ability to investigate security incidents and maintain audit trails required for compliance, exposing them to regulatory violations and operational blindness during breach response. Any TOTOLINK T6 router exposed to untrusted networks (including the internet) is at risk.
No vendor-released patch identified at time of analysis. Implement external syslog forwarding to preserve logs on a hardened off-device collector; restrict firewall access to /cgi-bin/cstecgi.cgi endpoint; segment router management interfaces from untrusted networks; require VPN authentication for remote administrative access; maintain daily offline log backups with integrity verification; enable alerting on suspicious POST requests to clearSyslog function.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB