EUVD-2026-67921
GHSA-6vvj-95pg-p2j8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface on LAN/WAN
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi getPasswordCfg
-
ExploitBypass missing auth check
-
ExecutionReceive administrative username
-
ImpactUse for targeted credential attack
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the TOTOLINK T6 web management service on firmware 4.1.5cu.748_B20211015 and the ability to POST to the /cgi-bin/cstecgi.cgi endpoint invoking the getPasswordCfg function; no authentication, credentials, or user interaction are needed (CVSS PR:N/UI:N). The primary limiting factor is reachability of the management interface: on default deployments this endpoint is exposed on the LAN, so a same-network attacker can exploit it directly, while remote exploitation is only possible if web management is exposed to the WAN/internet. The realized impact is limited to disclosure of the administrative username, not full device takeover. |
| Impact | Signals are mixed and warrant scrutiny. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) marks it as trivially exploitable over the network with no auth, and the network/no-auth exposure is credible for a LAN-facing CGI endpoint. However, the C:H/I:H/A:H impact rating substantially overstates reality: the description states only that the administrative USERNAME is disclosed - there is no integrity or availability impact and confidentiality impact is low, not high. EPSS is very low (0.18%), there is no KEV listing and no public PoC identified, so this is not under active exploitation. Realistically this is a low-severity information leak that is useful chiefly as a precursor step (knowing the admin account name aids brute-force/credential attacks) rather than a standalone critical compromise. Treat the 9.8 as inflated and prioritize accordingly. Note also the CPE and version metadata are placeholders ('n/a'), so authoritative affected-version confirmation is weak. |
| Exploit ScenarioDerived | An attacker with network reachability to the router's web interface sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking the getPasswordCfg function, with no credentials, and receives the administrator account username in the response. The attacker then uses that username to launch a targeted password-guessing or default-credential attack against the admin login. No public PoC has been identified, but the request is simple enough to reproduce from the description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve the administrative account username by sending a crafted POST request to the getPasswordCfg handler of /cgi-bin/cstecgi.cgi. The flaw is reported by MITRE with no public exploit identified at time of analysis and a low EPSS score (0.18%, 7th percentile); it is not listed in CISA KEV. Although scored CVSS 9.8, the concrete impact is limited to leaking the admin username, which is best treated as reconnaissance that lowers the effort of a subsequent password-guessing or credential attack.
RemediationAI
No vendor-released patch version is identified at time of analysis; check the TOTOLINK download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for a firmware build newer than 4.1.5cu.748_B20211015 and apply it once published. As compensating controls: ensure the router's web management interface (HTTP/HTTPS on the LAN/WAN) is not exposed to the internet - block external access to the management port at the perimeter, which prevents remote reach but does not stop a LAN-side attacker; restrict management access to a trusted management VLAN or specific admin hosts via ACLs, at the cost of admin convenience; and because the leaked username aids credential attacks, set a long, high-entropy administrator password and enable any available login rate-limiting/lockout to blunt follow-on brute-forcing. If the device is end-of-support with no forthcoming fix, plan replacement with a currently-maintained model. Vendor coordination trackers: https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md and https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected device is TOTOLINK's T6 mesh/router, whose web management runs through the common cstecgi.cgi CGI dispatcher at /cgi-bin/cstecgi.cgi that routes JSON POST bodies to named handler functions. The getPasswordCfg function returns configuration relating to the administrator account but fails to enforce any authentication or session check before responding, which is the hallmark of CWE-284 (Improper Access Control). The root cause is that a sensitive read handler is reachable pre-authentication rather than an input-validation or memory-safety bug; the exposed value here is the administrative username. This same cstecgi.cgi dispatcher and missing-authorization pattern recurs across many TOTOLINK T6 endpoints (getWanCfg, getWiFiWpsCfg, getNtpCfg, etc.).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network POST to the CGI endpoint (AV:N/AC:L/PR:N/UI:N) but the only disclosed data is the admin username, so C:L and no integrity or availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the administrative username via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
Administrative usernames for TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) can be exposed via an unauthenticated attack, enabling adversaries to target privileged accounts and compromise network infrastructure. This creates business risk for organizations relying on these devices for critical network connectivity.
No vendor-released patch identified at time of analysis. Implement compensating controls including network segmentation restricting administrative interface access to authorized personnel and management networks only; deploy firewall rules blocking unauthenticated access to router management interfaces from external sources; enforce complex, unique administrative credentials; disable remote management capabilities if operationally feasible; implement network monitoring to detect attempts to access the vulnerable endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB