Description
Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Published: 2026-08-28
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the getWizardCfg function of TOTOLINK T6 firmware. An unauthenticated attacker can send a specially crafted POST request to /cgi-bin/cstecgi.cgi and retrieve the setup wizard and onboarding configuration data. This reveals sensitive configuration settings that an attacker could use to further compromise or clone the device. The weakness arises from improper access control that fails to verify authentication before exposing the data.

Affected Systems

The flaw affects TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015.

Risk and Exploitability

The CVSS score is not listed, the EPSS score is not available, and the vulnerability is not included in CISA’s KEV catalog. Based on the description, any entity with network visibility to the device can exploit the flaw by sending a POST request without authentication and obtain confidential configuration information. While no publicly available exploit or high exploitation probability has been reported, the exposure of configuration data may assist additional attacks and therefore presents a moderate risk.

Generated by OpenCVE AI on August 28, 2026 at 20:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the TOTOLINK T6 router to a firmware revision that corrects the access control in getWizardCfg; refer to the vendor’s release notes for the patch.
  • If a patch is unavailable, isolate the device by placing it behind a firewall or VLAN that blocks external access to the /cgi-bin/cstecgi.cgi endpoint; restrict inbound traffic only from trusted management networks.
  • Disable or cleanse the wizard and onboarding configuration data on the router, removing any default credentials or exposed parameters that could be leveraged if accessed.

Generated by OpenCVE AI on August 28, 2026 at 20:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink t6
Vendors & Products Totolink
Totolink t6

Fri, 28 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access to Setup Wizard Configuration in TOTOLINK T6 4.1.5cu
Weaknesses CWE-200
CWE-284

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink T6
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-28T15:47:13.976Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51618

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-28T20:18:04.963

Modified: 2026-08-28T21:20:39.190

Link: CVE-2026-51618

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T21:00:04Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control