EUVD-2026-69212
GHSA-p232-m4c6-prj3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach T6 web interface on LAN/WAN
-
ExploitCraft POST to /cgi-bin/cstecgi.cgi
-
ExecutionInvoke clearDiagnosisLog without auth
-
ImpactDiagnosis logs erased (anti-forensics)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the TOTOLINK T6 web management endpoint /cgi-bin/cstecgi.cgi on firmware 4.1.5cu.748_B20211015; no authentication, credentials, or user interaction are needed, and default configurations are affected. The practical limiting factor is exposure of the management interface: by default it is reachable on the LAN, so Internet-wide exploitation depends on remote administration being enabled or the interface otherwise being forwarded/exposed to the WAN. |
| Impact | Signals conflict sharply. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) rates this as critical with full triad impact, but the described action is limited to erasing diagnosis logs - a write/delete operation with no confidentiality read and no service outage. Realistic impact is integrity-only (log/audit destruction, anti-forensics), so C:H and A:H are overstated; a score near 4-5 is more defensible. Supporting this, SSVC records Exploitation: none and EPSS is only 0.18% (7th percentile), and the CVE is not in CISA KEV. Automatable: yes and Technical Impact: total reflect the trivially scriptable pre-auth reachability, not a system takeover. Net: low urgency as an isolated issue, but it should be patched as part of the broader unauthenticated-cstecgi.cgi exposure on this device. |
| Exploit ScenarioDerived | An attacker on the same network (or the Internet if remote management is exposed) sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking clearDiagnosisLog with no credentials, wiping the router's diagnosis logs. This is most useful as an anti-forensic step to destroy evidence after or during other attacks against the device. No public PoC is noted, but the request is trivial to script. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Unauthenticated log erasure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete diagnosis logs by sending a crafted POST request to the clearDiagnosisLog handler at /cgi-bin/cstecgi.cgi. The endpoint enforces no authentication, so any attacker with network reach to the web management interface can wipe diagnostic records. No public exploit identified at time of analysis and EPSS is low (0.18%), but the flaw is one of a large cluster of unauthenticated cstecgi.cgi handler weaknesses reported against this device.
RemediationAI
No vendor-released patch version is identified in the supplied data; monitor the TOTOLINK T6 download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) and the coordination trackers for updated firmware. As compensating controls, restrict access to the web management interface: ensure /cgi-bin/cstecgi.cgi is not exposed to the WAN/Internet (disable remote administration), and confine LAN management to trusted hosts/VLANs or an admin subnet via firewall/ACL - this blocks the network vector at the cost of remote manageability. Given the device shares this pre-auth dispatcher flaw across many functions, treat the whole management surface as untrusted until patched, and consider replacing end-of-support hardware if no fixed firmware ships.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer mesh Wi-Fi router. Its web administration relies on a single CGI dispatcher, /cgi-bin/cstecgi.cgi, which routes requests to named functions (here clearDiagnosisLog) based on POST body parameters. The root cause is CWE-284 Improper Access Control: the dispatcher invokes the log-clearing routine without verifying an authenticated session, so a privileged maintenance action is reachable pre-auth. This is a recurring architectural pattern across the T6 firmware, where numerous get*/set*/clear* handlers share the same missing-authorization defect. clearDiagnosisLog specifically erases the device's stored diagnostic/troubleshooting log data rather than reading or altering configuration.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable handler (AV:N/AC:L/PR:N/UI:N), but action only erases diagnosis logs - integrity impact is limited (I:L), with no data read (C:N) or service disruption (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Executive ViewAI
TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows unauthenticated remote attackers to erase diagnostic logs via the clearDiagnosisLog endpoint, destroying critical audit trails and forensic evidence without authentication. Organizations relying on these routers for network management face loss of incident investigation capability and violation of compliance mandates requiring log retention for SOC2, ISO27001, and regulatory audits.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict web management interface access to trusted administrative networks via firewall ACLs; (2) enable centralized syslog forwarding to preserve logs on external server; (3) implement immutable log archival and backup; (4) deploy network monitoring to alert on clearDiagnosisLog requests; (5) disable web management interface if SSH is available as alternative. These controls mitigate but do not eliminate the vulnerability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB