EUVD-2026-68678
GHSA-w7f8-gvq4-6rfg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP interface on network
-
DeliveryCraft POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke setOpModeCfg without auth
-
ExecutionDevice changes operating mode
-
ImpactConnectivity disrupted or rerouted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's HTTP management service and the ability to send a POST request to the /cgi-bin/cstecgi.cgi endpoint invoking the setOpModeCfg function - no authentication, credentials, or user interaction are needed against the affected firmware (4.1.5cu.748_B20211015). The practical limiting factor is exposure of that management interface: by default it is bound to the LAN, so an Internet-based attacker succeeds only where remote/WAN management of the web UI has been enabled, whereas any LAN or Wi-Fi-adjacent attacker can reach it directly. Impact is confined to that specific device and firmware build. |
| Impact | The signals are mixed. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N, score 9.1) rates this critical based on network reach and no authentication, and the unauthenticated + low-complexity profile is genuinely dangerous on any network segment the attacker can reach. However, the confidentiality-high rating is questionable: changing the operating mode is fundamentally an integrity/availability action, not an information-disclosure one, so C:H likely overstates data-exposure risk while understating potential availability impact. No EPSS score was provided, there is no KEV listing, and no POC is referenced, so there is no evidence of active or automated exploitation - this reads as a real but not-yet-weaponized configuration-tampering flaw. Practical exposure is limited by network reachability: consumer routers are usually only attackable from the LAN/adjacent network unless the web interface is exposed to the WAN. |
| Exploit ScenarioDerived | An attacker with access to the router's network (an adjacent Wi-Fi client, a compromised LAN host, or the Internet if remote management is enabled) sends a single crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setOpModeCfg with no credentials. The device accepts the request and switches its operating mode, dropping or rerouting connectivity for all users behind it; because AC:L and PR:N, the request is trivial to reproduce and no user interaction is needed. No public POC is currently referenced, but the attack is a simple scripted HTTP request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Operating-mode tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers alter the device's operating mode by POSTing to the /cgi-bin/cstecgi.cgi endpoint, because the setOpModeCfg handler performs no access-control check. An attacker on the network path can reconfigure how the router operates (e.g. router/AP/repeater mode), disrupting connectivity or repositioning the device for further attack. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.
RemediationAI
No vendor-released patched firmware version is identified at time of analysis; the referenced links point to the general TOTOLINK site, a download page, and third-party coordination READMEs rather than a specific fixed build, so administrators should check the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for a firmware release superseding 4.1.5cu.748_B20211015 and apply it once published. As compensating controls until a fix is available: ensure the router's web/CGI management interface (/cgi-bin/cstecgi.cgi) is not exposed to the WAN/Internet - disable remote management, which has no downside for typical home use; restrict LAN-side access to the management interface to trusted hosts or a management VLAN, at the cost of some administrative convenience; and monitor for unexpected operating-mode or WAN-config changes as a detection fallback. Because the flaw is unauthenticated, strong admin passwords do not mitigate it - network-level isolation is the meaningful control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the CGI backend (cstecgi.cgi) common to TOTOLINK SOHO routers, which dispatches configuration actions by name - here the setOpModeCfg function that controls the WAN/operating-mode configuration. The root cause is CWE-284 (Improper Access Control): the handler is reachable and actionable without any authenticated session or authorization gate, so a request that should require an administrative session is honored from an unauthenticated context. This is characteristic of embedded router firmware where individual CGI 'topicurl'/function handlers each enforce (or fail to enforce) their own session checks rather than relying on a central authorization middleware.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network POST with no interaction (AV:N/AC:L/PR:N/UI:N); changing operating mode is an integrity action that also disrupts service (I:H/A:H), with no inherent data disclosure (C:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015 and earlier) contain a critical vulnerability allowing remote unauthenticated attackers to reconfigure device operating modes, causing network disruption and enabling lateral attack positioning. Organizations deploying this router model face immediate risk of service outages without urgent intervention. No vendor patch is available, requiring immediate containment.
Network segmentation and access control: restrict inbound connections to the /cgi-bin/cstecgi.cgi endpoint via firewall rules, limit router management access to trusted administrative networks only. Deploy network monitoring to alert on unauthorized operating-mode configuration changes. Isolate affected routers from critical infrastructure. These mitigations reduce risk but do not eliminate it; replacement or vendor patch release is required for complete remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB