EUVD-2026-68537
GHSA-qrpj-63w2-5rxp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliverySend crafted POST to cstecgi.cgi
-
ExploitInvoke setScheduleCfg without auth
-
ExecutionRegister forced-reboot schedule
-
ImpactDevice reboots repeatedly (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to send an HTTP POST to the /cgi-bin/cstecgi.cgi endpoint invoking the setScheduleCfg function on a TOTOLINK T6 running firmware 4.1.5cu.748_B20211015; per CVSS PR:N/UI:N no authentication, credentials, or user interaction are required. The primary limiting factor is network reachability of the management interface: exploitation from the internet requires remote administration to be enabled or the device otherwise WAN-exposed, whereas in a default LAN-only configuration the attacker must already be on the local network (or pivot through a compromised LAN host). Exploitation is also constrained to the specific affected firmware build; other versions are unverified. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) reflects a genuinely low-barrier attack: network-reachable, no authentication, no user interaction. However, the claimed impact profile deserves scrutiny - the described behavior is scheduling forced reboots, which is squarely an availability (DoS) issue and a configuration-integrity issue, whereas the input's C:H/I:H/A:H rating asserts full confidentiality loss that the description does not substantiate; verify the confidentiality claim against the vendor before treating data theft as confirmed. No EPSS score, KEV entry, or POC was supplied, so exploitation probability cannot be quantified from the data - absence of these signals is not evidence of safety, since consumer routers exposed to the WAN are routinely mass-scanned. Practically, any operator running this firmware with the management interface reachable should treat availability disruption as a realistic and easy outcome, and even a small municipal or mid-sized ISP support team should prioritize firmware review rather than deferring it on the assumption that a niche router model is uninteresting to attackers. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface - for example on a network where remote management is enabled, or from the LAN - sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking setScheduleCfg with no credentials, registering a recurring forced-reboot task. The device then reboots on the attacker's schedule, causing a persistent denial of service; because AC is low and no authentication or user interaction is required, the request can be scripted and repeated at scale. No public POC is referenced at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers abuse the setScheduleCfg handler on /cgi-bin/cstecgi.cgi to schedule forced reboot tasks without any credentials. Because the endpoint fails to enforce access control (CWE-284), a single crafted POST can register recurring reboots that render the device persistently unavailable, and the same missing check likely exposes other schedule/config parameters. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is trivial and network-reachable.
RemediationAI
No vendor-released fixed firmware version is identified in the provided data, so no exact patch version can be cited - check the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for a build newer than 4.1.5cu.748_B20211015 and apply it once released. As compensating controls: ensure the router's web management interface (cstecgi.cgi) is not exposed to the WAN/Internet - disable remote administration so /cgi-bin/cstecgi.cgi is reachable only from the LAN, which eliminates unauthenticated external access at the cost of losing off-network management; restrict LAN-side access to the management subnet or trusted admin hosts via firewall/ACL rules, accepting reduced convenience; and monitor for unexpected scheduled-reboot behavior as a detection signal. If the device is at end-of-life or no updated firmware appears, plan hardware replacement, since the missing access check is unauthenticated and cannot be safely mitigated while the interface remains reachable.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TOTOLINK SOHO routers expose a CGI backend at /cgi-bin/cstecgi.cgi that dispatches JSON/form actions to internal handlers; setScheduleCfg is the routine responsible for cron-like scheduled tasks such as timed reboots. The root cause is CWE-284 (Improper Access Control): the handler does not verify session authentication or authorization before accepting the request, so any client that can reach the web interface can invoke privileged configuration functions. The CPE string provided ('cpe:2.3:a:n/a:n/a:*') is a placeholder and does not identify the product; identification here relies on the description, which pins the exact firmware build 4.1.5cu.748_B20211015 on the T6 model.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote request (AV:N/AC:L/PR:N/UI:N); impact is forced reboots so A:H, config change gives I:L, and no disclosure supports C:N rather than the input's C:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 can be remotely forced into repeated reboots without authentication, causing persistent network outages that disable business operations and remote access. Any organization using this router model faces immediate operational risk, and while no public exploit has been identified at time of analysis, the attack is trivial and network-accessible. This critical unauthenticated vulnerability requires urgent mitigation to prevent business continuity disruptions.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict network access to /cgi-bin/cstecgi.cgi endpoint via firewall (block POST requests to setScheduleCfg handler); (2) disable remote administrative interfaces if not operationally critical; (3) isolate affected routers to trusted networks only; (4) implement automated configuration backups to enable rapid recovery; (5) monitor device uptime and authentication logs for unexpected restart patterns; (6) consider replacement with alternative router hardware pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB