TOTOLINK T6 EUVD-2026-68633

The TOTOLINK T6 router's web management interface (typically HTTP on port 80) must be reachable by the attacker - from the WAN if remote management is enabled, or from within the LAN. No authentication is required (confirmed by PR:N in the CVSS vector). Exploitation is confined to the specific firmware version 4.1.5cu.748_B20211015; other versions are neither confirmed vulnerable nor confirmed patched. The delPortForwardRules function must be reachable via the /cgi-bin/cstecgi.cgi dispatcher. Exploitation is strictly limited to deletion of NAT port-forwarding rules - it does not grant shell access, expose credentials, or allow reading or writing of other configuration. The primary limiting factor for most deployments is that the management interface defaults to LAN-only access, meaning exploitation from the internet requires a non-default configuration (WAN management enabled).

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects a low-effort, unauthenticated, network-reachable attack with significant integrity impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so automated exploitation at scale has not been confirmed. The real-world risk is highly dependent on exposure: if the router's management interface is only LAN-accessible (default for most SOHO deployments), the attacker surface is limited to internal network actors. However, operators who have enabled WAN-side management access face meaningful risk, and even a mid-sized municipal IT team managing distributed branch offices should treat this as urgent if TOTOLINK T6 devices are in scope and management ports are externally reachable. The impact is bounded - only port-forwarding rule integrity is affected, with no credential exposure or code execution - but targeted deletion of critical forwarding rules could silently disrupt VoIP, remote access, or operational services relying on those NAT entries.

An attacker who can reach the TOTOLINK T6 web management interface (typically TCP port 80) crafts a POST request to /cgi-bin/cstecgi.cgi with parameters invoking the delPortForwardRules action and targeting specific rule identifiers, submitting it without any session cookie or authentication credential. The router processes the request and removes the specified forwarding rules, silently disrupting any service (VoIP gateway, remote desktop, internal server) that relied on those NAT entries. No POC code has been publicly confirmed, but the attack requires only a single HTTP request with known endpoint structure.