EUVD-2026-68007
GHSA-24g8-x36j-cf39
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP interface (LAN/adjacent/WAN)
-
DeliveryPOST getPortForwardRules to /cgi-bin/cstecgi.cgi
-
ExploitMissing auth check returns rule table
-
ExecutionHarvest internal IPs and forwarded ports
-
ImpactMap network and pivot to exposed services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web management service and the ability to send a POST request to /cgi-bin/cstecgi.cgi invoking the getPortForwardRules function; no authentication, credentials, or user interaction are needed (PR:N/UI:N). The practical limiting factor is exposure: the attacker must be able to reach the CGI endpoint, which by default is the LAN/Wi-Fi side - WAN exploitation only applies if remote management is enabled or the interface is otherwise internet-exposed. Impact is limited to disclosure of port-forwarding rules on the specific firmware build 4.1.5cu.748_B20211015; there is no state change. |
| Impact | Signals conflict on severity. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N = 9.1) rates this Critical, but the description describes a read-only leak of port-forwarding rules - there is no configuration modification, so the I:H component is overstated; a C:L/I:N assessment is more defensible and would drop the base score substantially. Exploitation-probability signals are low and consistent: EPSS 0.18% (7th percentile), CISA SSVC exploitation 'none', and no POC found - though SSVC does mark it Automatable=yes with Technical Impact=total. In practice this is an easy-to-automate but low-impact reconnaissance primitive: real risk comes from chaining the leaked internal topology with other TOTOLINK T6 flaws (many sibling unauth endpoints exist), not from this disclosure alone. Net: lower operational priority than the 9.1 implies, but trivially exploitable and worth patching on exposed devices. |
| Exploit ScenarioDerived | An attacker who can reach the router's HTTP interface (a WAN-exposed device, or any host on the LAN/adjacent Wi-Fi) sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking getPortForwardRules and receives the full port-forward table without logging in. They use the leaked internal IPs and forwarded service ports to map the network and pivot toward exposed internal services or to chain other unauthenticated TOTOLINK T6 endpoints. No public exploit is identified, but the request is trivial to script. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve the device's port-forwarding rules by sending a crafted POST request to the getPortForwardRules handler at /cgi-bin/cstecgi.cgi. The endpoint enforces no authentication (CWE-284), exposing internal host IPs, service ports, and NAT mappings that aid downstream targeting. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and CISA SSVC lists exploitation status as none.
RemediationAI
No vendor-released patch version is identified at time of analysis; the referenced links are vendor/download and coordination pages, not a tagged fixed build, so monitor https://www.totolink.net/ and the TOTOLINK coordination README for a firmware update superseding 4.1.5cu.748_B20211015 and apply it once published. Until a fix ships, restrict reachability of the management interface: ensure the router's web/CGI service (/cgi-bin/cstecgi.cgi) is not exposed to the WAN or untrusted LAN segments - disable remote/WAN administration (trade-off: no off-LAN management), and place the device management VLAN behind firewall rules that permit only trusted admin hosts (trade-off: added network complexity). Treat any port-forwarding rules already exposed as known to attackers and review/rotate the internal services they map to.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TOTOLINK T6 is a consumer mesh Wi-Fi router. Like the rest of the TOTOLINK line, its web/management backend routes API-style calls through a single CGI dispatcher, /cgi-bin/cstecgi.cgi, which selects an internal handler by a function name in the POSTed body. The getPortForwardRules handler returns the configured virtual-server/port-forward table but omits the session/authentication check that privileged read operations require, so any network-reachable client can invoke it. The root cause class is CWE-284 (Improper Access Control) - a missing authorization gate on a sensitive read function rather than a memory-safety or injection bug. The CPE in the feed (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not identify the product; the affected product is TOTOLINK T6 firmware 4.1.5cu.748_B20211015.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network read of port-forward rules gives limited confidentiality (C:L) with no modification (I:N) or availability impact, contra the input's C:H/I:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015 and earlier) expose internal network topology-host IP addresses, service ports, and NAT configurations-to remote unauthenticated attackers. This information disclosure enables network reconnaissance and targeted attacks against internal systems, creating a significant attack surface for any organization deploying this router model.
Restrict WAN-facing access to router management interfaces using firewall rules; disable remote administration; segment router management traffic from production networks; monitor for POST requests to /cgi-bin/cstecgi.cgi from external IP addresses; log and alert on getPortForwardRules API calls; review and restrict NAT/port-forwarding rules to only necessary mappings. No vendor-released patch identified at time of analysis-interim mitigations are essential pending firmware update availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB