EUVD-2026-68743
GHSA-9rcc-9879-8p63
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach T6 web interface on network
-
DeliverySend crafted POST to /cgi-bin/cstecgi.cgi
-
ExploitInvoke unauthenticated LoadDefSettings handler
-
ExecutionConfiguration reset to factory defaults
-
ImpactDevice reboots, clients dropped and defaults restored
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6 web management service at /cgi-bin/cstecgi.cgi and the ability to send a crafted POST request invoking the LoadDefSettings function on firmware 4.1.5cu.748_B20211015; no authentication, credentials, or user interaction are needed (CVSS PR:N/UI:N). The primary limiting factor is management-interface exposure: default TOTOLINK configurations typically do not expose the admin interface to the WAN, so remote internet exploitation depends on remote/WAN administration being enabled or the device otherwise being reachable, whereas an on-path or same-LAN attacker can trigger it against a default LAN-facing interface. It is specific to the T6 model and the named firmware build. |
| Impact | The published CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is directionally right on attack vector - network-reachable, no authentication, no user interaction, low complexity - but overstates confidentiality: a config reset and reboot primarily destroy integrity of settings and cause an availability outage; there is no direct data-exfiltration primitive, so C:H is not well supported (assessed C:N). The realistic severity is closer to 9.1 (I:H/A:H). Countervailing signals are notable: EPSS is only 0.18% (7th percentile), the CVE is not in CISA KEV, and no public PoC is referenced, so mass exploitation is not currently indicated. That said, exposure risk is real because the operation is trivially triggerable and can knock a device offline or silently revert it to default credentials, so any operator running a T6 with the web interface reachable should treat this as urgent and firewall the management endpoint. Net: high inherent risk on internet-exposed units, tempered by low observed exploitation activity to date. |
| Exploit ScenarioDerived | An attacker who can reach the router's web service - for example a device with WAN-side management exposed, or an attacker already on the LAN/guest network - sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking LoadDefSettings. The router wipes its configuration to factory defaults and reboots, dropping all clients, undoing security hardening, and re-enabling default credentials, which the attacker or a follow-on actor can then use. No authentication, user interaction, or public exploit tooling is required given the low attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated factory-reset and reboot in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers wipe device configuration and force a restart by sending a crafted POST request to the LoadDefSettings handler in /cgi-bin/cstecgi.cgi. No credentials are required, and the action both disrupts service (reboot) and destroys operator settings by restoring defaults, which can re-expose default credentials and undo hardening. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the CVE is not in CISA KEV.
RemediationAI
No vendor-released patch version is identified at time of analysis; monitor TOTOLINK's support/download pages (https://www.totolink.net/ and the T6 download page) and the vendor-coordination trackers (https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md and https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md) for a fixed firmware release, then upgrade to it. Until a patch is available, the highest-value compensating control is to ensure the web management interface (and cstecgi.cgi) is never reachable from the WAN - disable remote/WAN administration in the router settings, which prevents internet-based exploitation at the cost of losing remote management. On the LAN side, restrict management access to a trusted admin VLAN or specific hosts via ACLs (side effect: other LAN clients can no longer reach the admin UI), and if the device supports it, disable or filter the HTTP admin service where not needed. Because the flaw needs no authentication, changing the admin password alone does not mitigate it; after any inadvertent reset, immediately reconfigure and re-set a strong admin password since the device will have reverted to defaults.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer/SOHO mesh Wi-Fi router. Its web management backend is the CGI binary cstecgi.cgi, which dispatches JSON-style function names to internal handlers; here the LoadDefSettings handler restores factory-default configuration and reboots the device. The root cause is CWE-284 (Improper Access Control): the LoadDefSettings function performs a privileged, state-destroying operation without verifying that the requester is authenticated or authorized. This mirrors a broad pattern of missing authorization checks across many cstecgi.cgi handlers in this firmware line. The CPE in the feed is a placeholder (cpe:2.3:a:n/a:n/a:*), so the affected product must be read from the description as TOTOLINK T6 rather than from structured CPE data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network POST with no interaction (AV:N/AC:L/PR:N/UI:N); action resets config and reboots (I:H/A:H) but discloses no data directly (C:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015 and potentially other versions) can be remotely reset to factory defaults and rebooted by unauthenticated attackers with no credentials required. This destroys all device configurations and re-exposes default credentials, creating both immediate service disruption and a pathway for further network compromise in any organization using this equipment.
Network segmentation and firewall rules to restrict access to the management interface and /cgi-bin/cstecgi.cgi endpoint from untrusted sources; disable remote management capabilities; implement access logging and monitoring for POST requests to vulnerable endpoints; maintain documented baseline configurations for rapid reconfiguration if reset occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB