EUVD-2026-67905
GHSA-24gj-cqmc-xxh9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed TOTOLINK T6 management interface
-
ExploitSend unauthenticated POST to /cgi-bin/cstecgi.cgi with getInitCfg action
-
ExecutionBypass absent access control check
-
ImpactReceive sensitive device initialization configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required - the CVSS vector (PR:N, UI:N) confirms fully unauthenticated, no-interaction exploitation. The attacker must have TCP network connectivity to the TOTOLINK T6 web management interface (typically port 80). Exploitation is limited to the specific firmware version 4.1.5cu.748_B20211015 on TOTOLINK T6 hardware; other versions are not confirmed affected. The impact is strictly bounded to information disclosure - there is no code execution, no write access, and no availability impact. For the majority of home and SOHO deployments where WAN-side management is disabled by default, exploitation requires local network access, substantially reducing realistic exposure. |
| Impact | CVSS 7.5 (High) is driven by the fully network-reachable, unauthenticated, no-interaction attack profile with high confidentiality impact - metrics that accurately reflect the technical nature of the flaw. However, real-world risk signals are markedly lower: EPSS at 0.18% (7th percentile) indicates very low exploitation probability in practice, SSVC rates exploitation as 'none' and technical impact as only 'partial,' and there is no CISA KEV listing and no public POC. The impact is strictly limited to information disclosure (I:N, A:N), ruling out direct compromise or service disruption. SSVC's 'automatable: yes' rating means the flaw could be swept into mass-scanning tooling, but the niche consumer/SOHO footprint of TOTOLINK T6 constrains realistic exposure. Overall, this is a genuine but low-urgency finding - high CVSS reflects worst-case technical conditions, while empirical risk signals suggest limited active interest. |
| Exploit ScenarioDerived | An attacker with network access to an internet-exposed TOTOLINK T6 management interface sends a crafted HTTP POST request to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to retrieve sensitive device initialization configuration by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint without credentials. The getInitCfg handler performs no access control checks before returning configuration data, confirmed by a CVSS PR:N vector. Despite a CVSS score of 7.5, exploitation likelihood is low - EPSS sits at 0.18% (7th percentile) and SSVC reports no observed exploitation - though the attack is fully automatable with no user interaction required.
RemediationAI
Check the TOTOLINK firmware download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for an updated firmware release; no specific patched version number is confirmed in the available data, so verify directly with TOTOLINK. As an immediate compensating control, restrict access to the router's web management interface to trusted LAN segments only and disable remote (WAN-side) management if not operationally required - this eliminates the network attack vector entirely with no functional trade-off for most deployments. Firewall rules blocking external access to TCP port 80/443 on the management interface achieve the same effect on networks where the device cannot be directly reconfigured.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TOTOLINK T6 uses a CGI-based web management interface where the HTTP server dispatches POST requests to /cgi-bin/cstecgi.cgi to named handler functions. The getInitCfg function is responsible for returning device initialization configuration but is missing authentication or authorization checks, constituting a classic CWE-284 (Improper Access Control) failure. Any caller - authenticated or not - can invoke this handler and receive the configuration response. The affected firmware is version 4.1.5cu.748_B20211015. CPE data in NVD uses the placeholder cpe:2.3:a:n/a:n/a rather than a proper TOTOLINK identifier; the actual product is confirmed as TOTOLINK T6 from the CVE description and vendor references.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network call to read-only CGI handler; C:H reflects potential exposure of sensitive init config, I:N and A:N confirmed by description.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive device configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 router firmware contains an unauthenticated information disclosure vulnerability allowing remote attackers to retrieve sensitive device initialization configuration without authentication. This exposure could enable attackers to obtain information for follow-on compromise or lateral movement attacks, impacting organizations using affected firmware versions for network connectivity.
No vendor-released patch identified at time of analysis. Implement firewall or WAF rules to restrict access to /cgi-bin/cstecgi.cgi; disable remote management access if not operationally critical; apply network segmentation to isolate affected devices from untrusted network segments; monitor access logs for suspicious POST requests to the vulnerable endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB