EUVD-2026-67925
GHSA-674f-prpq-5p64
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify TOTOLINK T6 management interface on network
-
DeliverySend unauthenticated POST to /cgi-bin/cstecgi.cgi with getWiFiMeshConfig action
-
ExploitReceive mesh configuration and runtime state data
-
ExecutionMap mesh topology and node addresses
-
ImpactTarget mesh nodes or connected clients for follow-on attacks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Network-level reachability to the TOTOLINK T6 HTTP management interface is the sole prerequisite. CVSS PR:N/UI:N/AC:L confirms no authentication, no user interaction, and no special configuration is required on the router itself - the vulnerability exists in the default firmware state. Exploitation is bounded by network topology: LAN-side users can exploit by default; remote attackers require WAN-side remote management to be enabled, which is a non-default configuration on most consumer routers. The specific firmware version 4.1.5cu.748_B20211015 is named in the CVE; other versions are neither confirmed vulnerable nor confirmed safe. |
| Impact | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects genuine ease of exploitation: network-accessible with no credentials, no complexity, and no user interaction. However, impact is strictly limited to confidentiality - no integrity or availability compromise is possible through this endpoint. SSVC rates automation as yes (trivially scriptable) and technical impact as partial, meaning this is a real but bounded vulnerability. EPSS at 0.18% (7th percentile) indicates no measurable exploitation activity in current threat telemetry, consistent with SSVC exploitation=none. The practical risk is concentrated in deployments where the management interface is exposed beyond the LAN - if WAN-side remote management is disabled (the common default), the attack surface is restricted to local network users. The mesh configuration data exposed could enable network reconnaissance and identification of mesh node addresses for follow-on attacks, but does not directly enable code execution or persistence. |
| Exploit ScenarioDerived | An attacker with network access to the TOTOLINK T6 management interface sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi specifying the getWiFiMeshConfig action with no authentication headers or session tokens. The router returns the full mesh network configuration and runtime state, revealing node addresses, mesh topology, and operational parameters. The attacker uses this data to map the mesh network and identify additional nodes or connected hosts for follow-on targeting. No public proof-of-concept code has been identified, though the technique is trivially constructible from the CVE description alone. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated access to the getWiFiMeshConfig endpoint on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh network configuration and runtime state to any attacker reachable over the management interface. The CGI handler at /cgi-bin/cstecgi.cgi fails to enforce authentication before executing getWiFiMeshConfig, returning sensitive mesh topology data in response to a single crafted POST request with no credentials. No public exploit or active exploitation has been identified; EPSS at 0.18% (7th percentile) and SSVC exploitation=none confirm low observed exploitation pressure despite the SSVC automatable=yes rating.
RemediationAI
No vendor-released patch has been identified at time of analysis. Monitor TOTOLINK firmware releases at https://www.totolink.net/ and the T6 download page at https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html for updates. As an immediate compensating control, restrict access to the router's HTTP management interface and specifically to /cgi-bin/cstecgi.cgi using firewall ACLs on upstream network equipment, limiting reachability to trusted LAN hosts only - this eliminates the network attack vector without requiring a firmware change. If WAN-side remote management is enabled, disable it immediately, as this is the highest-risk configuration. Do not expose port 80 or the management interface to untrusted VLANs or guest networks. These controls do not remediate the underlying authentication bypass but render the vulnerability unexploitable from external networks.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TOTOLINK T6 is a consumer/SOHO mesh Wi-Fi router running embedded Linux firmware version 4.1.5cu.748_B20211015. The vulnerable component is the getWiFiMeshConfig CGI function handler exposed via /cgi-bin/cstecgi.cgi, the router's primary web management API. CWE-284 (Improper Access Control) applies: the function executes and returns sensitive output - mesh node configuration, runtime state, and topology data - without performing any authentication or session validation check on the incoming POST request. This class of flaw is endemic to TOTOLINK firmware, where multiple CGI functions in the same cstecgi.cgi dispatcher share this access control failure pattern. CPE data carries the placeholder cpe:2.3:a:n/a:n/a rather than an accurate TOTOLINK entry.
Know when TOTOLINK gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible unauthenticated endpoint; no credentials required; impact is read-only confidentiality disclosure with no integrity or availability consequence.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 expose mesh network topology and configuration to unauthenticated attackers, enabling network reconnaissance. No public exploit identified at time of analysis, but the lack of vendor patch and unauthenticated access requirement necessitate immediate isolation of management interfaces. Organizations deploying this model must restrict access to prevent disclosure of infrastructure intelligence that could support follow-on network attacks.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management interface access via firewall rules to authorized administrative networks only; implement network segmentation to isolate affected devices from untrusted networks; disable mesh functionality if operationally feasible; deploy monitoring for suspicious access to the getWiFiMeshConfig endpoint; maintain detailed access logs for audit and incident response.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Rated critical severit
TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via th
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Rated critical s
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th
Exploit-DB