EUVD-2026-67904
GHSA-j65q-2cwp-c6px
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP interface
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi (getWanCfg)
-
ExploitBypass absent access control
-
ExecutionRead WAN configuration data
-
ImpactHarvest ISP/PPPoE credentials for follow-on attacks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web service on /cgi-bin/cstecgi.cgi and the ability to send a POST request invoking the getWanCfg function; no authentication, credentials, or user interaction are needed (CVSS PR:N/UI:N). The primary limiting factor is reachability of the management interface: by default this is LAN-side, so remote Internet exploitation requires remote management to be enabled or the port otherwise exposed. The condition is also constrained to the specified firmware, 4.1.5cu.748_B20211015; other versions are not confirmed affected by the provided data. |
| Impact | The vendor CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) rates this Critical, but the impact metrics appear overstated: the description states only that WAN configuration data can be *obtained* (a read/disclosure), which supports C:H but not I:H - there is no indication of a write/modification primitive, so a more defensible assessment is C:H/I:N/A:N (base 7.5, High). Exploitability signals are genuinely favorable to an attacker: unauthenticated, network-reachable, low complexity, no user interaction. Countervailing this, EPSS is very low (0.18%, 7th percentile) and the CVE is not in CISA KEV with no public PoC identified, so realistic near-term exploitation is limited and would more likely be targeted than mass-automated. The dominant real-world exposure driver is whether the device's management interface is reachable from the WAN/Internet; on default LAN-only deployments the attack surface is confined to the local network. Organizations running these routers at branch or remote sites should still prioritize remediation because leaked WAN credentials can enable follow-on compromise, but the low EPSS and absence of exploitation evidence argue against treating it as an emergency relative to KEV-listed issues. |
| Exploit ScenarioDerived | An attacker who can reach the router's HTTP management port - either on the LAN, or over the Internet if remote management is exposed - sends a single crafted POST request invoking getWanCfg to /cgi-bin/cstecgi.cgi and receives the WAN configuration in response, with no login. Given low attack complexity and no authentication, the request is trivial to script; no public PoC is currently identified, but the exploitation barrier is minimal. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve WAN configuration data by sending a crafted POST request to the getWanCfg handler at /cgi-bin/cstecgi.cgi. The getWanCfg function fails to enforce access control, so no credentials are required to read WAN settings (which can include ISP connection details, PPPoE usernames/passwords, and IP configuration). No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the device is not in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis; no fixed firmware version is listed in the provided data, so a specific upgrade target cannot be cited. As compensating controls: ensure the router's web management interface is not exposed to the WAN/Internet (disable any remote-management option) so /cgi-bin/cstecgi.cgi is reachable only from trusted LAN segments; restrict LAN access to the management interface via client isolation or a management VLAN where supported; and monitor the vendor download portal (https://www.totolink.net/) for updated T6 firmware and apply it once released. Because the affected router is end-user CPE, the trade-off of the disable-remote-management control is loss of off-site administration, which is acceptable for most deployments. Coordination references indicate ongoing vendor disclosure tracking: https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md .
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer/SOHO mesh Wi-Fi router. Like most TOTOLINK devices, its web management is served by a single CGI dispatcher, /cgi-bin/cstecgi.cgi, which routes JSON POST requests to internal handler functions by name - here, getWanCfg. The root cause is CWE-284 (Improper Access Control): the getWanCfg handler does not verify an authenticated/authorized session before returning data, so the dispatcher services the request from any caller. This is the same architectural weakness that recurs across many cstecgi.cgi handlers on this platform, where individual functions omit the session/authentication check that the framework does not centrally enforce. The CPE in the feed is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not identify the real product.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network read of WAN config gives C:H; description shows disclosure only with no modification or DoS, so I:N/A:N (not the vendor's I:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) expose WAN configuration data, including ISP credentials and PPPoE passwords, to unauthenticated remote attackers via an unprotected endpoint with no authentication required. While no public exploit identified at time of analysis, the absence of a vendor patch means organizations must immediately implement network controls to protect against unauthorized credential disclosure and potential network reconfiguration.
No vendor-released patch identified at time of analysis. Interim mitigations include: disable remote administrative access unless operationally required; implement network segmentation to restrict external access to the vulnerable endpoint; configure firewall rules to block external HTTP/HTTPS requests to affected devices; establish logging and alerting for POST requests to getWanCfg; audit and rotate ISP credentials and PPPoE passwords; monitor TOTOLINK advisories for future firmware updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB