Description
Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Published: 2026-08-28
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized System Reboot
Action: Immediate Patch
AI Analysis

Impact

A flaw in the access control logic of the RebootSystem function in the TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows an attacker who can send HTTP requests to the device to trigger an immediate reboot. The vulnerability does not allow the attacker to execute arbitrary code, but it can be used to cause denial of service or to disrupt operational continuity by forcing the device to reset.

Affected Systems

TotalLink T6 routers running firmware version 4.1.5cu.748_B20211015 are affected. The flaw exists in the web interface component that processes POST requests to the endpoint /cgi-bin/cstecgi.cgi.

Risk and Exploitability

The exploitation requires only a crafted POST request and no authentication, so it can be performed by attackers who can reach the router over the network. The CVSS score of 4.3 indicates a low severity vulnerability, and it is not listed in the CISA KEV catalog. The EPSS score of < 1% suggests a very low probability of exploitation. The lack of authentication and the impact of forcing a reboot mean the potential for disruption is significant.

Generated by OpenCVE AI on September 1, 2026 at 23:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade firmware to a patched version that enforces authentication for the RebootSystem function.
  • Restrict management access to the router by implementing firewall rules or VLAN segmentation so that only trusted internal networks can reach the /cgi-bin/cstecgi.cgi endpoint.
  • Configure network monitoring or intrusion detection to alert on suspicious POST requests to /cgi-bin/cstecgi.cgi and automatically block them.

Generated by OpenCVE AI on September 1, 2026 at 23:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Reboot via RebootSystem

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Fri, 28 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Reboot via RebootSystem
Weaknesses CWE-284

Fri, 28 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink t6
Vendors & Products Totolink
Totolink t6

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink T6
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-01T19:04:57.912Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51610

cve-icon Vulnrichment

Updated: 2026-09-01T19:04:52.562Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T20:18:04.200

Modified: 2026-09-01T19:17:21.380

Link: CVE-2026-51610

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T00:00:06Z

Weaknesses