EUVD-2026-67874
GHSA-3753-236x-jr2j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke getIpPortFilterRules unauthenticated
-
ExecutionReceive IP/port filtering rules
-
ImpactMap firewall policy for further targeting
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web-management service at /cgi-bin/cstecgi.cgi and the ability to send a POST request invoking the getIpPortFilterRules function; per CVSS PR:N/UI:N no authentication or user interaction is needed. The practical limiting factor is exposure of the management interface: by default this is LAN-facing, so remote exploitation depends on WAN-side administration being enabled or the attacker having LAN/adjacent access. Confirmed affected build is firmware 4.1.5cu.748_B20211015; behavior on other firmware is unconfirmed. |
| Impact | Signals conflict on real-world priority. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) rates the flaw Critical, but the description only supports reading filtering rules - a read-only disclosure - so the I:H (high integrity impact) component appears overstated; a defensible base is closer to C:L/I:N/A:N. Corroborating a lower urgency, EPSS is just 0.18% (7th percentile), SSVC records Exploitation as 'none' (no observed exploitation or public PoC), and there is no CISA KEV listing - no public exploit identified at time of analysis. Counterbalancing, SSVC marks the issue Automatable=yes with Technical Impact=total, and it is unauthenticated and network-reachable, so mass scanning is plausible even though impact per target is limited to configuration disclosure. Net: treat this as a genuine but moderate exposure - a mid-sized operator should patch it in routine cycles rather than as an emergency, while noting the CVSS/description mismatch and verifying scope with the vendor. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface (e.g., over the LAN, or over the WAN if remote management is exposed) sends a single crafted POST request invoking getIpPortFilterRules on /cgi-bin/cstecgi.cgi and receives the device's IP/port filtering rules without logging in. The low attack complexity and lack of authentication make this scriptable at scale; no public PoC is known, but the request pattern is trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read the device's IP and port filtering rules by sending a crafted POST request to the getIpPortFilterRules handler at /cgi-bin/cstecgi.cgi. The endpoint fails to enforce access control (CWE-284), exposing firewall/filter configuration to anyone who can reach the web interface. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile).
RemediationAI
No vendor-released patch version is identified at time of analysis; monitor the TOTOLINK download/firmware page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) and apply any updated T6 firmware that supersedes 4.1.5cu.748_B20211015 as soon as it is published. As compensating controls, restrict access to the router's web-management interface so /cgi-bin/cstecgi.cgi is not reachable from the WAN or from untrusted LAN segments - disable remote (WAN-side) administration entirely (trade-off: no off-LAN management), and place the management interface behind an ACL or management VLAN limited to trusted admin hosts (trade-off: added network configuration and possible loss of convenience access). Because the endpoint is unauthenticated, changing the admin password does not mitigate it; network-level access restriction is the effective control until firmware is updated.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the cstecgi.cgi CGI backend that services the TOTOLINK T6's web-management API, a common architecture across TOTOLINK consumer/SOHO routers where a single endpoint dispatches to named functions such as getIpPortFilterRules. The root cause is CWE-284 (Improper Access Control): the getIpPortFilterRules function does not verify an authenticated session before returning data, so a request that should require operator login is served to any caller. The disclosed data - IP and port filtering (firewall) rules - reveals the device's network-access policy, which can aid subsequent targeting. The CPE in the input is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not name the vendor/product; the real affected product is TOTOLINK T6 per the description and vendor references.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network POST (AV:N/AC:L/PR:N/UI:N) yields read-only disclosure of filtering rules, so C:L with no integrity or availability impact (I:N/A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IP and port filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) contain a critical unauthenticated vulnerability that exposes the device's firewall and port filtering rules to remote attackers. An attacker can retrieve sensitive network security configurations without authentication, enabling reconnaissance and informed planning of attacks against the organization's network perimeter.
Restrict network access to the router's administrative interface (ports 80/443) to authorized management VLANs only; implement firewall rules to block external access to management endpoints; monitor for POST requests to getIpPortFilterRules endpoints; consider deploying the device behind a management firewall or appliance that controls administrative access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB