EUVD-2026-67903
GHSA-xj3w-wj7g-8gf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router network interface
-
DeliverySend unauthenticated POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke getDdnsStatus action
-
ExecutionReceive DDNS hostname and public IP
-
ImpactUse for network reconnaissance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required and no special configuration must be enabled - the getDdnsStatus function is accessible to any host that can reach /cgi-bin/cstecgi.cgi via HTTP POST. Exploitation is limited to network-reachable attackers: LAN-side access is always sufficient; WAN-side exploitation requires that remote management be enabled on the device (non-default on most consumer routers, but commonly misconfigured). No user interaction is needed. The firmware version must be exactly 4.1.5cu.748_B20211015; exploitability against other firmware versions is not confirmed from available data. |
| Impact | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) places this in High severity, but the C:H metric warrants scrutiny: the exposed data - DDNS runtime status and public IP - is of limited confidentiality sensitivity since public IP is inherently externally visible and DDNS hostname is typically public by design. A more accurate independent assessment would rate this C:L, yielding a score closer to 5.3. SSVC characterizes Technical Impact as 'partial' and Exploitation as 'none', consistent with the EPSS score of 0.18% (7th percentile), which signals very low real-world exploitation pressure. The attack IS automatable (no authentication, no interaction, simple POST request), which could enable mass scanning to enumerate device presence and network topology. No KEV listing and no confirmed POC raise the practical risk below what the raw CVSS implies. This is a real but low-priority finding - notable for reconnaissance value rather than direct system compromise. |
| Exploit ScenarioDerived | An attacker with network access to the router - either on the LAN, via an exposed WAN management interface, or from the same network segment - sends an unauthenticated POST request to http://[router-ip]/cgi-bin/cstecgi.cgi invoking the getDdnsStatus action. The router responds with DDNS runtime state including the configured hostname and the router's current public IP address, which the attacker uses to map the target's external network presence and confirm the router model for further exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes DDNS runtime status and the router's public IP address to any network-reachable attacker. The getDdnsStatus function in the CGI interface fails to enforce access control, allowing a crafted POST request to /cgi-bin/cstecgi.cgi to return sensitive network configuration without credentials. No active exploitation is confirmed (CISA KEV absent, EPSS at 0.18%), though SSVC notes the attack is automatable with no required privileges or user interaction.
RemediationAI
No vendor-released patched firmware version is identified at time of analysis. Administrators should check https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html for updated firmware releases. As compensating controls, restrict LAN-side access to the router management interface (/cgi-bin/cstecgi.cgi) by disabling remote WAN management and applying firewall rules to limit CGI access to trusted management hosts only - this limits exploitation to attackers already on the local network segment. If DDNS is not in use, disabling the DDNS feature may reduce the information exposure surface, though this does not patch the missing access control. Note that restricting the management interface port may affect legitimate administrative access.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TOTOLINK T6 is a consumer/SMB wireless router running embedded Linux firmware. The CGI endpoint /cgi-bin/cstecgi.cgi serves as the primary API gateway for router management functions. The getDdnsStatus handler, responsible for returning Dynamic DNS runtime state including the configured DDNS hostname, update status, and the router's external (WAN/public) IP address, applies no authentication check before responding. The root cause is CWE-284 (Improper Access Control) - the function exists on the same endpoint as authenticated operations but lacks any session or credential validation gate. The affected firmware version is 4.1.5cu.748_B20211015. CPE data provided is a placeholder (n/a) and does not accurately reflect the product; the real CPE should target TOTOLINK T6.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated access warrants AV:N/PR:N, but exposed data (public IP, DDNS status) is low-sensitivity, so C:L not C:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers expose the organization's public IP address and DDNS status to any network-reachable attacker without authentication, enabling network reconnaissance and infrastructure discovery. This vulnerability affects organizations using these devices for edge network connectivity and creates an exposed reconnaissance vector for attackers to map network boundaries. With no vendor patch available, organizations must urgently implement network-level controls to prevent exposure.
Implement firewall rules to restrict unauthenticated access to the /cgi-bin/cstecgi.cgi endpoint, disable remote management interfaces if not operationally required, and place affected routers behind network segmentation. Monitor network logs and IDS alerts for suspicious queries targeting DDNS or IP configuration endpoints on these devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB