EUVD-2026-68712
GHSA-2j8w-jrrx-p4hr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web endpoint
-
ExploitCraft POST to cstecgi.cgi delDevice
-
ExecutionBypass absent access control
-
ImpactDelete managed slave device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web management endpoint /cgi-bin/cstecgi.cgi and the ability to send a POST request invoking the delDevice function; no authentication, credentials, or user interaction are required (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is exposure of the management interface: against a default LAN-only deployment the attacker must already be on the local network, whereas devices with remote/WAN administration enabled are exploitable from the internet. Only the specified firmware 4.1.5cu.748_B20211015 is confirmed affected, and impact is bounded to deletion of managed slave devices rather than full device takeover. |
| Impact | Signals conflict. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) describes trivial unauthenticated network exploitation, which matches the description. However, the impact metrics look mis-scored: the described action is deleting a managed slave device - an integrity/availability effect - yet the vector claims C:H/I:H with A:N, which is questionable since deletion does not obviously leak data and does reduce availability of the removed device. Counterweighing the high CVSS, EPSS is only 0.16% (6th percentile), there is no CISA KEV listing and no identified public exploit, suggesting real-world exploitation is currently low and, if it occurs, likely targeted or opportunistic against exposed devices rather than widespread. SSVC-style read: exploitation=none observed, automatable=yes (single unauthenticated request), technical impact limited to device-management state. Net priority is moderate: easy to exploit but low current activity and bounded impact (device removal, not full compromise). |
| Exploit ScenarioDerived | An attacker who can reach the router's web interface (e.g., a device on the LAN, or the WAN interface if remote management is exposed) sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking delDevice with a target slave-device identifier. With no authentication check, the router deletes the specified managed device from its mesh/management set, disrupting network topology. No public proof-of-concept is currently identified, but the low complexity (AC:L) makes weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated device deletion in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers remove any managed slave device by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The delDevice function fails to enforce access control (CWE-284), so no credentials are needed. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), indicating limited observed interest despite the high CVSS 9.1 rating.
RemediationAI
No vendor-released patch version is identified at time of analysis; monitor TOTOLINK's firmware download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-51729) for an updated firmware image and apply it once released. As compensating controls: disable remote/WAN administration so /cgi-bin/cstecgi.cgi is not reachable from the internet (trade-off: no remote management); restrict access to the LAN management interface via firewall/ACL to trusted management hosts only (trade-off: administrative inconvenience for casual users); and place the router's management plane on an isolated VLAN. Because the endpoint requires no authentication, network-level access restriction is the most reliable mitigation until firmware is patched.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TOTOLINK T6 is a consumer/SOHO mesh Wi-Fi router. Like most TOTOLINK devices, its web management interface routes requests through the CGI handler /cgi-bin/cstecgi.cgi, which dispatches named functions (here, delDevice) based on JSON POST parameters. The root cause is CWE-284 Incorrect Access Control: the delDevice endpoint does not validate that the requester is an authenticated administrator before acting, effectively an authentication bypass for that operation. The supplied CPE (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not correctly identify the affected product, which is TOTOLINK T6 firmware 4.1.5cu.748_B20211015.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated single request (AV:N/AC:L/PR:N/UI:N); deletion is an integrity write (I:H) reducing the removed device's availability (A:L); no data disclosure so C:N, diverging from the input's C:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015 and related versions) are vulnerable to unauthenticated remote device deletion, enabling attackers to remove managed slave devices and disrupt device management operations without requiring any credentials. This directly impacts operational continuity and management integrity for organizations relying on these routers as access point controllers. No vendor patch is currently available, requiring immediate compensating controls.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management web interface (TCP 80/443) access via firewall rules to trusted administrative IP ranges only; disable remote management and HTTPS access from untrusted networks; implement detailed logging and alerting on all management API calls, particularly delDevice requests; maintain current inventory snapshots to rapidly identify unauthorized deletions; if managing critical infrastructure, temporarily isolate or replace affected units until patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB