EUVD-2026-68584
GHSA-68j6-9q5v-hxhw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach T6 management interface on LAN/WAN
-
DeliveryCraft unauthenticated POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke setUpgradeFW without credentials
-
ExecutionAlter firmware-upgrade workflow
-
ImpactIntegrity compromise or device denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 management web server and the ability to send a POST request to /cgi-bin/cstecgi.cgi invoking the setUpgradeFW handler; no authentication, credentials, or user interaction are needed (PR:N/UI:N). The practical limiting factor is exposure: by default the management interface listens on the LAN, so an attacker must be on the local/adjacent network unless remote (WAN) management is enabled, which widens exposure to the internet. It is specific to firmware build 4.1.5cu.748_B20211015 of the T6; other builds/models are not confirmed affected from the available data. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H = 9.1) describes a network-reachable, low-complexity, unauthenticated flaw with high integrity and availability impact and no confidentiality impact - consistent with tampering with a firmware-upgrade routine rather than reading data. However, the EPSS probability is very low (0.18%, 7th percentile), there is no CISA KEV entry, and no public PoC is referenced, so real-world exploitation pressure is currently modest and likely opportunistic rather than mass-automated. The realistic ceiling is high: if the upgrade workflow can be pointed at attacker-supplied firmware it becomes full device takeover; if it merely disrupts/aborts upgrades it is closer to availability-only. The description ('trigger firmware-upgrade workflow changes') is vague on whether arbitrary firmware can be flashed, so the I:H/A:H rating is plausible but not fully substantiated - verify the exact upgrade behavior against the vendor before treating this as guaranteed RCE-equivalent. Net: prioritize on internet-exposed or shared-network T6 devices, but treat the concrete impact as partially inferred. |
| Exploit ScenarioDerived | An attacker who can reach the router's management interface - either across the LAN (guest Wi-Fi, compromised local host) or against a device with remote management exposed to the internet - sends a single crafted unauthenticated POST to /cgi-bin/cstecgi.cgi invoking setUpgradeFW. Given AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed, and the attacker manipulates the firmware-upgrade workflow to disrupt the device or, in the worst case, push tampered firmware for persistent control. No public exploit code is currently referenced, so an attacker would craft the request from the endpoint's known parameter format. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Improper access control in the setUpgradeFW function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers alter the firmware-upgrade workflow by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Because the CGI endpoint enforces no authentication, an attacker on a reachable network can tamper with the device's firmware update process, risking integrity compromise and denial of service (bricking). EPSS is low (0.18%, 7th percentile) and there is no public exploit or KEV listing at time of analysis.
RemediationAI
No vendor-released fixed firmware version is identified in the available data, so no exact patch version can be cited - monitor the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for an update superseding 4.1.5cu.748_B20211015. As compensating controls: ensure the router's web/management interface (cstecgi.cgi) is not exposed to the WAN/internet - disable any remote-management option and block inbound access to the HTTP management port from untrusted networks; restrict LAN-side access to the /cgi-bin/cstecgi.cgi endpoint to trusted management hosts via segmentation or a firewall/ACL, accepting that this can break legitimate app-based configuration; and consider replacing end-of-support hardware if the vendor does not ship a fix. Because the flaw is unauthenticated, changing the admin password does not mitigate it. Track the vendor-coordination READMEs above for fix status.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer mesh Wi-Fi router whose web/management interface is driven by the cstecgi.cgi CGI binary. Requests are dispatched to internal handler functions by a 'topicurl'/function name in the POST body; setUpgradeFW is the handler governing the firmware-upgrade workflow. The root cause is CWE-284 (Improper Access Control): the handler is exposed via cstecgi.cgi without verifying an authenticated administrative session, so any client that can reach the endpoint invokes privileged upgrade logic. This mirrors a broad pattern of unauthenticated cstecgi.cgi handlers on the T6 (numerous sibling CVEs in the 4.1.5cu.748_B20211015 build). The CPE in the feed, cpe:2.3:a:n/a:n/a, is a placeholder and does not identify the real product, which is the TOTOLINK T6 router firmware.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Unauthenticated network POST to the CGI upgrade handler (AV:N/AC:L/PR:N/UI:N); tampering with the firmware-upgrade workflow yields high integrity and availability (brick) impact, no data read (C:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers are vulnerable to remote device-disabling attacks that require no credentials. Unauthenticated attackers can manipulate firmware updates to brick devices, causing network outages and forcing expensive hardware replacement. With no vendor patch available, organizations relying on this router model face immediate and ongoing risk.
No vendor-released patch identified at time of analysis. Interim mitigations: implement firewall rules and network ACLs restricting POST requests to /cgi-bin/cstecgi.cgi; disable or restrict remote firmware-upgrade functionality at the network perimeter; isolate affected routers to dedicated, authenticated administrative networks; monitor for any firmware update announcements from TOTOLINK; consider temporary replacement units from alternative vendors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB