Description
Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Published: 2026-08-28
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The getWiFiEasyCfg function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 contains an improper access control flaw that allows attackers without authentication to send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve the SSID and Wi‑Fi password. This disclosure enables attackers to join the wireless network and potentially perform further attacks. The weakness aligns with CWE-284, improper access control, and CWE-200, exposure of sensitive information to an unauthorized actor.

Affected Systems

TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015 are affected. No other versions are listed in the advisory.

Risk and Exploitability

The vulnerability is accessible over the router’s web interface without requiring credentials, so an attacker simply needs network reachability to the device. Although no EPSS or CVSS values are available, the lack of authentication and the value of the leaked data suggest a high exploitation likelihood. The flaw is not included in the CISA KEV catalog.

Generated by OpenCVE AI on August 28, 2026 at 20:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade TOTOLINK router firmware to the latest release that addresses the information disclosure flaw.
  • If an update is unavailable, block access to /cgi-bin/cstecgi.cgi or disable the Wi‑Fi Easy Config feature using firewall or router ACL rules.
  • Disable Wi‑Fi Easy Config entirely or configure it to require authentication before use.
  • Ensure the Wi‑Fi SSID and password are strong, unique, and changed periodically.
  • Monitor network traffic for unexpected POST requests to cstecgi.cgi to detect exploitation attempts.

Generated by OpenCVE AI on August 28, 2026 at 20:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink t6
Vendors & Products Totolink
Totolink t6

Fri, 28 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Information Disclosure in TOTOLINK T6 Wi‑Fi Configuration
Weaknesses CWE-200
CWE-284

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink T6
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-28T16:03:43.287Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51625

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-28T20:18:05.713

Modified: 2026-08-28T21:25:22.770

Link: CVE-2026-51625

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T22:30:17Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control