EUVD-2026-68583
GHSA-gj22-mg3h-w927
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify reachable T6 management interface
-
DeliveryCraft POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke setWiFiSignalCfg without authentication
-
ExecutionModify transmit power or trigger fault condition
-
ImpactWireless clients denied connectivity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The router's HTTP management interface (/cgi-bin/cstecgi.cgi) must be network-reachable from the attacker's position. On SOHO deployments this interface is accessible by default from the LAN; if WAN-side management is enabled, unauthenticated remote exploitation is possible from the internet without any additional prerequisites. No authentication, no session token, no user interaction, and no special protocol beyond HTTP POST are required. Exploitation is bounded by: impact confined to the wireless subsystem of the targeted TOTOLINK T6 only; firmware must be exactly version 4.1.5cu.748_B20211015 (other firmware versions are neither confirmed vulnerable nor safe); and the management port must be reachable from the attacker's network position. |
| Impact | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the zero-authentication, network-accessible attack surface, but the I:N metric understates the actual impact: invoking setWiFiSignalCfg with attacker-controlled parameters constitutes a configuration-integrity violation in addition to potential service denial. EPSS at 0.18% (7th percentile) confirms that automated exploitation has not materialized, and the vulnerability is absent from CISA KEV. The attack is fully automatable with no credentials, no user interaction, and only standard HTTP - meaning that even a mid-sized municipal IT team in walbrzych managing a fleet of these routers should treat any exposure of the management interface to untrusted networks as a material operational risk. Practical blast radius is confined to disrupting wireless service on the targeted router, with no path to credential exfiltration or lateral movement, which moderates real-world priority relative to the headline CVSS score. |
| Exploit ScenarioDerived | An attacker with network access to the router's management interface crafts a minimal HTTP POST to /cgi-bin/cstecgi.cgi, invoking setWiFiSignalCfg with parameters that reduce transmit power to zero or supply an invalid value that triggers a fault condition. No credentials are required and no user interaction occurs. All wireless clients of the affected access point immediately lose connectivity or experience severely degraded signal, constituting a sustained denial of service until the router is rebooted or manually reconfigured. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated remote attackers can arbitrarily modify wireless transmit-power settings or deny wireless service on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 by sending a crafted POST to the device's CGI management interface. The setWiFiSignalCfg function is reachable without any authentication gate, a CWE-284 improper access control defect that allows an adversary to degrade or eliminate wireless connectivity for all clients on the affected device. No public exploit code or CISA KEV listing is recorded; EPSS at 0.18% (7th percentile) reflects minimal current exploitation interest despite trivially automatable attack conditions.
RemediationAI
No vendor-released patch has been identified at the time of analysis for firmware 4.1.5cu.748_B20211015. As an immediate compensating control, restrict access to the router's web management interface (the /cgi-bin/cstecgi.cgi endpoint) to trusted LAN segments only, blocking all WAN-side or untrusted-network access to port 80/443 on the management plane - this eliminates the network-accessible attack surface entirely. If the device supports management ACLs or VLAN isolation for the admin interface, apply them to further limit the exposure radius. Monitor the TOTOLINK firmware download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for firmware updates addressing this access control defect. The GitHub coordination repositories cited in the references (DarkBoulder and ShengWu00) may provide additional disclosure timeline context.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer/SOHO wireless router running firmware version 4.1.5cu.748_B20211015. Its web management interface processes configuration actions via POST requests to /cgi-bin/cstecgi.cgi, dispatching to named handler functions. The setWiFiSignalCfg handler is responsible for adjusting wireless transmit power but exposes this functionality without enforcing authentication, a textbook CWE-284 (Improper Access Control) defect where access to a privileged operation is not gated by identity verification. The CPE string in the advisory (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) is a data-entry placeholder; the correct vendor and product are TOTOLINK and T6 respectively. Two independent GitHub CVE coordination repositories and the TOTOLINK vendor firmware download page are cited as references.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
setWiFiSignalCfg writes attacker-controlled transmit-power config (I:L integrity impact); DoS is A:H; all other metrics match unauthenticated, network-reachable attack with no complexity.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service (DoS) via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are vulnerable to unauthenticated remote denial-of-service attacks that allow attackers to disable wireless service for all clients without any credentials. An adversary can arbitrarily reduce transmit power or shut down WiFi connectivity, creating organization-wide network outages that affect all wireless users.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network-layer access to the device's CGI management interface to authorized administrative subnets only via firewall ACLs; (2) Disable remote management features if available in device settings; (3) Deploy monitoring alerts for unexpected wireless outages or signal-strength degradation; (4) Replace affected devices with vendors that provide active security maintenance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB