TOTOLINK T6 EUVD-2026-68676

The management web interface at /cgi-bin/cstecgi.cgi must be network-reachable from the attacker's position. In the default consumer router configuration, this interface is typically bound to the LAN-side interface, limiting exploitation to devices already on the local network (wired or wireless clients, including guests). If the operator has enabled remote management (WAN access to the admin interface), the attack surface expands to unauthenticated internet-based attackers. No special configuration of the delUrlFilterRules feature itself is required - the missing access control is unconditional. Exploitation is limited to firmware version 4.1.5cu.748_B20211015; other versions have not been confirmed vulnerable or safe based on available data.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects that exploitation is trivial - no authentication, no complexity, no user interaction required. The singular impact is integrity: an attacker can erase URL filtering rules, which could allow bypassing parental controls, corporate content policies, or DNS-level block lists enforced on the router. EPSS data is absent from the provided intelligence, limiting probabilistic exploitation forecasting. No CISA KEV listing exists, and no confirmed public exploit code has been identified - the references point to researcher vendor-coordination repositories rather than weaponized proof-of-concept releases. Real-world risk is moderated by the product's consumer/SOHO footprint and the likelihood that the management interface is LAN-bound in typical deployments. Attackers already on the LAN (e.g., compromised devices, rogue Wi-Fi clients) represent the primary realistic threat. If remote management is enabled, the risk surface expands to the internet.

An attacker already on the local network - such as a compromised LAN device or a guest Wi-Fi client - sends a crafted unauthenticated POST request to http://[router-IP]/cgi-bin/cstecgi.cgi invoking delUrlFilterRules with the target rule identifiers. The router processes the deletion without verifying session credentials, removing one or all URL filtering rules and silently disabling any content filtering or parental-control policies in effect. If remote management is enabled, this scenario extends to internet-facing attackers with no additional prerequisites.