EUVD-2026-67898
GHSA-239m-fwjx-g3mq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi (getWiFiWpsCfg)
-
ExploitReceive WPS config with PIN
-
ExecutionDerive Wi-Fi PSK from PIN
-
ImpactJoin wireless network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's HTTP management endpoint /cgi-bin/cstecgi.cgi and the ability to send a POST invoking the getWiFiWpsCfg function; no authentication, credentials, or user interaction are needed (PR:N/UI:N). The concrete limiting factor is reachability of the web interface: by default this is exposed on the LAN, so the practical prerequisite is being on (or able to route to) the device's management network - full internet-facing exploitation additionally requires WAN-side remote management to be enabled. It is confined to TOTOLINK T6 firmware 4.1.5cu.748_B20211015 as described. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N, base 9.1) indicates a network-reachable, low-complexity, unauthenticated attack, which aligns with the description of an unauthenticated POST request. However, the vector's I:H (high integrity impact) appears overstated: the described behavior is read-only disclosure of WPS configuration, so the primary technical impact is confidentiality (C:H) with integrity impact being indirect at best (via subsequent unauthorized Wi-Fi access). Countervailing signals lower the practical urgency: EPSS is only 0.18% (7th percentile), the CVE is not in CISA KEV, and no public PoC is referenced - so this is not confirmed active exploitation, and the low EPSS suggests it is not yet part of commodity scanning. That said, the disclosed WPS PIN is a direct stepping-stone to full wireless access, so any operator with these routers exposed - whether a home user or a mid-sized municipal IT team - should treat internet-facing management interfaces as urgent to lock down. The realistic exposure depends heavily on whether the web interface is reachable from the WAN or only the LAN, which the advisory does not clarify. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface (e.g., on the LAN, or on the WAN if remote management is enabled) sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking getWiFiWpsCfg with no credentials, and receives the WPS configuration including the current PIN in the response. The attacker then uses the PIN to recover the Wi-Fi pre-shared key and join the network. No public PoC is referenced, but the request is trivial to reproduce given the described parameters. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read the device's WPS configuration - including the active WPS PIN - by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Because the getWiFiWpsCfg handler performs no access-control check, any party who can reach the web interface can harvest the PIN and use it to derive the Wi-Fi passphrase and join the network. No public exploit identified at time of analysis and EPSS is low (0.18%), but the trivial, network-reachable nature of the flaw makes it high-value against exposed devices.
RemediationAI
No vendor-released patch version is identified in the provided data at time of analysis; check the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for a firmware update newer than 4.1.5cu.748_B20211015 and apply it once available. As compensating controls: disable remote/WAN management so /cgi-bin/cstecgi.cgi is not reachable from the internet (trade-off: loses off-site administration); restrict access to the router web UI to specific trusted LAN hosts via ACL where the firmware supports it; and disable WPS entirely on the device (trade-off: users must join Wi-Fi with the passphrase manually, but this neutralizes the value of a leaked PIN). After disabling WPS, rotate the Wi-Fi passphrase in case the PIN was already harvested. Monitor the TOTOLINK site and NVD entry for a fixed build.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the CGI backend (cstecgi.cgi) of the TOTOLINK T6, a consumer/SOHO Wi-Fi mesh router. TOTOLINK devices route all administrative actions through cstecgi.cgi, dispatching on a function/topicurl parameter in the POST body; here the getWiFiWpsCfg function returns Wi-Fi Protected Setup (WPS) parameters. The root cause is CWE-284 (Improper Access Control): the endpoint fails to verify an authenticated session or authorization before returning sensitive data, so the PIN is served to anonymous callers. WPS PINs are especially sensitive because the 8-digit PIN can be brute-forced or reused to recover the WPA/WPA2 pre-shared key, effectively bypassing wireless authentication. The supplied CPE (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not correctly identify the vendor/product.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network read of the WPS PIN is pure confidentiality loss; no direct integrity or availability impact, so I:N/A:N rather than the source's I:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) expose the active WPS PIN to any remote attacker without authentication, enabling unauthorized Wi-Fi network access that bypasses encryption protections. This affects all organizations deploying these devices and creates an uncontrolled network perimeter vulnerability that allows attackers to join internal networks.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) disable WPS on all affected TOTOLINK T6 devices to eliminate the attack surface for PIN extraction; (2) restrict router web interface access to trusted administrative networks only; (3) disable remote management features if enabled; (4) implement network segmentation to limit lateral movement if an attacker joins the Wi-Fi network; (5) enable and monitor router access logs for unauthorized connection attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB