EUVD-2026-68671
GHSA-p3pg-hj3g-7395
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface on LAN
-
ExploitSend crafted POST to /cgi-bin/cstecgi.cgi
-
ExecutionInvoke delSmartQosCfg without auth
-
ImpactSmart QoS rules deleted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6's web management endpoint /cgi-bin/cstecgi.cgi and the ability to send a POST request invoking the delSmartQosCfg function; per the CVSS vector (PR:N/UI:N) no authentication and no user interaction are needed, and it works against the default firmware 4.1.5cu.748_B20211015. The practical limiting factor is exposure of that management interface: on a typical deployment the web UI is LAN-only, so an attacker must already be on the local network unless remote/WAN administration has been enabled, which narrows realistic attackers to on-network parties or cases where the admin panel is internet-exposed. Impact is further limited in scope - the request deletes Smart QoS rules rather than granting code execution or data disclosure. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) rates this Critical on the strength of unauthenticated network reachability, but the C:H/I:H/A:H impact appears inflated relative to the described behavior: deleting Smart QoS rules is a configuration-integrity and availability concern, not a confidentiality breach, so the true impact is narrower than a full-system compromise. The exposure caveat matters - SOHO router web interfaces are normally LAN-facing, so 'network' realistically means an attacker already on the local network or one able to reach an internet-exposed admin panel, and the low EPSS (0.16%) with no KEV listing and no public PoC suggests real-world exploitation is currently theoretical rather than widespread. Even so, because exploitation requires no authentication and no user interaction, a mid-sized operator running these devices at branch sites should treat unauthenticated config deletion as a genuine hardening priority even though the blast radius per request is limited to QoS settings. |
| Exploit ScenarioDerived | An attacker with access to the router's LAN - or to an internet-exposed admin interface - sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking delSmartQosCfg, and the router deletes the configured Smart QoS rules with no login required. Repeating the request lets the attacker keep QoS disabled, degrading traffic prioritization for the network. No public exploit code is identified at time of analysis, but the request is trivial to reproduce given the low attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete Smart QoS rules by sending a crafted POST request to the delSmartQosCfg handler at /cgi-bin/cstecgi.cgi. The endpoint performs no access-control check, so any attacker able to reach the device's web interface can remove QoS configuration without credentials. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis, so this reads as a broadly exploitable but not-yet-weaponized SOHO router flaw.
RemediationAI
No vendor-released patched firmware version is identified in the available data, so no exact fix version can be cited; monitor the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for an updated firmware image for the T6 and apply it once published. As compensating controls, disable remote/WAN management so /cgi-bin/cstecgi.cgi is never reachable from the internet (trade-off: administrators lose off-LAN management), restrict access to the router's web UI to a trusted management VLAN or specific admin hosts via firewall/ACL rules (trade-off: added network configuration and possible lockout risk if rules are wrong), and place the device behind a segmented network so untrusted LAN clients cannot reach the admin CGI. Because the flaw only removes Smart QoS rules, also keep an exported copy of the QoS configuration so it can be restored quickly if deleted.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the CGI back-end (cstecgi.cgi) that drives the TOTOLINK T6's web management interface, a common architecture in TOTOLINK/Realtek-based SOHO routers where each administrative action is dispatched to a named function (here delSmartQosCfg) via a POST body. The root cause is CWE-284 (Improper Access Control): the delSmartQosCfg function does not verify that the requester is an authenticated administrator before executing the delete operation, so the router treats an anonymous request as authorized. The declared CPE (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not correctly identify the product; the real target is the TOTOLINK T6 router firmware image 4.1.5cu.748_B20211015.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network POST (AV:N/AC:L/PR:N/UI:N) but the action only deletes QoS config, so C:N and integrity/availability are limited (I:L/A:L), not the input's C:H/I:H/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Smart QoS rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
Unauthenticated attackers can delete Quality of Service (QoS) configuration on TOTOLINK T6 routers, potentially disrupting network traffic prioritization for critical business applications and communications. Organizations deploying this device face network service degradation risk with no vendor patch available, requiring immediate access controls to mitigate exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict router management interface to internal-only access behind perimeter firewall-do not expose to internet; (2) Disable remote management features; (3) Enable configuration change logging and alerting to detect unauthorized QoS rule deletions; (4) Implement network segmentation isolating router management traffic; (5) Prioritize replacement with routers from vendors providing timely security maintenance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB