Description
Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Published: 2026-08-28
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch Firmware
AI Analysis

Impact

The vulnerability resides in the getWizardCfg function of TOTOLINK T6 firmware. An unauthenticated attacker can send a specially crafted POST request to /cgi-bin/cstecgi.cgi and retrieve the setup wizard and onboarding configuration data. This reveals sensitive configuration settings that an attacker could use to further compromise or clone the device. The weakness arises from improper access control that fails to verify authentication before exposing the data.

Affected Systems

The flaw affects TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015.

Risk and Exploitability

The CVSS score is 7.5, the EPSS score is < 1%, and the vulnerability is not included in CISA’s KEV catalog. Based on the description, any entity with network visibility to the device can exploit the flaw by sending a POST request without authentication and obtain confidential configuration information. While no publicly available exploit or high exploitation probability has been reported, the exposure of configuration data may assist additional attacks and therefore presents a high risk.

Generated by OpenCVE AI on September 2, 2026 at 07:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the TOTOLINK T6 router to a firmware revision that corrects the access control in getWizardCfg; refer to the vendor’s release notes for the patch.
  • If a patch is unavailable, isolate the device by placing it behind a firewall or VLAN that blocks external access to the /cgi-bin/cstecgi.cgi endpoint; restrict inbound traffic only from trusted management networks.
  • Disable or cleanse the wizard and onboarding configuration data on the router, removing any default credentials or exposed parameters that could be leveraged if accessed.

Generated by OpenCVE AI on September 2, 2026 at 07:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 08:15:00 +0000

Type Values Removed Values Added
Title Access Control Bypass Exposing Router Configuration

Wed, 02 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access to Setup Wizard Configuration in TOTOLINK T6 4.1.5cu
Weaknesses CWE-200

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink t6
Vendors & Products Totolink
Totolink t6

Fri, 28 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access to Setup Wizard Configuration in TOTOLINK T6 4.1.5cu
Weaknesses CWE-200
CWE-284

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink T6
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-01T16:14:39.223Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51618

cve-icon Vulnrichment

Updated: 2026-09-01T15:56:22.024Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T20:18:04.963

Modified: 2026-09-01T17:17:26.330

Link: CVE-2026-51618

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T08:00:14Z

Weaknesses