EUVD-2026-68711
GHSA-mmq8-f88f-qqvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface (LAN or exposed WAN)
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke delWiFiAclRules without auth
-
ExecutionWi-Fi ACL rules deleted
-
ImpactAccess restrictions bypassed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6's HTTP management endpoint /cgi-bin/cstecgi.cgi and the ability to send a POST request to the delWiFiAclRules function; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are needed against firmware 4.1.5cu.748_B20211015. The primary limiting factor is interface exposure: by default the management web UI is LAN-facing, so an unauthenticated remote attacker must already be on the local/wireless network or the device must have WAN-side/remote administration enabled to be reachable from the Internet. Impact is scoped to erasing the Wi-Fi ACL configuration on the affected device. |
| Impact | The signals are mixed and warrant scrutiny. The input CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) reflects trivial remote, unauthenticated access, and SSVC marks the flaw automatable with total technical impact - consistent with a scriptable, no-prerequisite request. However, the C:H (high confidentiality impact) rating is questionable: deleting Wi-Fi ACL rules is fundamentally an integrity/configuration-tampering action that removes a security control, not a data-disclosure primitive, so a more defensible scoring is integrity-high with no confidentiality impact (see assessed vector below). Real-world urgency is tempered by exposure: SOHO router management interfaces are normally LAN-facing, so mass Internet-wide exploitation depends on how many units expose the web UI to the WAN. SSVC lists Exploitation as 'none' and there is no KEV entry and no identified public POC, so this is a latent-but-serious weakness rather than an actively-exploited emergency - any operator running these devices should still patch promptly given how automatable the attack is. |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface - a malicious device on the LAN/Wi-Fi, or anyone on the Internet if remote management is exposed - sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking delWiFiAclRules, with no credentials. This wipes the configured Wi-Fi MAC ACL, removing whitelist restrictions so previously blocked clients can associate (or defeating a blacklist). The request is trivial to script and requires no user interaction, matching the automatable, low-complexity profile in the CVSS/SSVC data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 31, 2026
Access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote, unauthenticated attacker delete Wi-Fi ACL (access control list) rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delWiFiAclRules handler. Because the handler performs no authentication or authorization check, anyone able to reach the device's web management interface can strip the MAC-based wireless access restrictions. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CISA's SSVC assessment rates it as automatable with total technical impact.
RemediationAI
No vendor-released patch version is identified in the provided data at time of analysis; check the TOTOLINK firmware download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for an updated build for the T6 and apply it once available. As compensating controls, restrict access to the router's web management interface: disable remote (WAN-side) administration entirely so /cgi-bin/cstecgi.cgi is unreachable from the Internet (trade-off: administrators must be on the LAN to manage the device), and place the management interface on a trusted management VLAN or restrict it by source IP where the firmware permits (trade-off: added configuration complexity). Where feasible, treat the Wi-Fi ACL as a defense-in-depth layer only and rely on WPA2/WPA3 with a strong passphrase for primary wireless access control, since MAC-based ACLs can be removed by this flaw and are independently bypassable by MAC spoofing. Monitor the vendor coordination README (https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md) for fix status.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the CGI-based web management backend common to TOTOLINK SOHO routers, where a single dispatcher binary (/cgi-bin/cstecgi.cgi) routes JSON/POST requests to named functions by a 'topicurl'-style parameter. The vulnerable function, delWiFiAclRules, manages the Wi-Fi Access Control List that whitelists/blacklists client MAC addresses. The root cause is CWE-284 (Improper Access Control): the delWiFiAclRules routine can be invoked without any session token, login, or privilege check, so the authorization layer that should gate administrative configuration changes is simply absent for this action. The supplied CPE (cpe:2.3:a:n/a:n/a) is a placeholder and does not identify the product; the real affected product is derived from the description and vendor references (totolink.net).
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated remote POST (AV:N/AC:L/PR:N/UI:N) that deletes ACL config is an integrity impact (I:H); it discloses no data (C:N) and does not deny service (A:N), unlike the input's C:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) contain a critical unauthenticated access-control bypass allowing remote attackers to delete wireless MAC-based access restrictions. This exposes organizational networks to unauthorized device connectivity if affected routers are internet-accessible or on untrusted network segments. Leadership should prioritize mitigation immediately as the vulnerability is rated highly automatable by CISA, though no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: disable remote management access to affected routers; restrict TOTOLINK T6 devices to trusted network segments only; implement compensating network-level access controls; enable and monitor device configuration change logs for unauthorized modifications; consider temporary Wi-Fi disablement if business-critical data relies on MAC-based restrictions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB