Description
Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Published: 2026-08-28
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive information disclosure of DMZ configuration
Action: Patch ASAP
AI Analysis

Impact

The vulnerability is an incorrect access control in the getUrlFilterRules function of TOTOLINK T6 firmware. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve DMZ configuration information. This exposure of network configuration can assist attackers in planning further compromises, but the description does not state that any code is executed or direct control is obtained.

Affected Systems

TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015 are affected. No other product versions or vendors are listed in the data.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity impact, while the EPSS score of <1% suggests that exploitation is unlikely currently. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs network access and can send a crafted HTTP POST request to /cgi-bin/cstecgi.cgi without authentication or privilege escalation. The exposed DMZ configuration can aid further attacks but does not grant code execution. The risk can be considered moderate but potentially high if the router is exposed to untrusted networks.

Generated by OpenCVE AI on September 2, 2026 at 07:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify if TOTOLINK has released a firmware update that corrects the access control flaw and upgrade to that version if possible.
  • If a patch is not yet available, restrict external network access to the router’s administrative interface, for example by enabling local firewall rules or requiring VPN access before HTTP requests can reach /cgi-bin/cstecgi.cgi.
  • Configure the router to enforce authentication on the getUrlFilterRules endpoint or disable DMZ configuration exposure if the firmware allows it.
  • Monitor router logs for abnormal POST requests to /cgi-bin/cstecgi.cgi and consider blocking repeated suspicious attempts with an IDS/IPS rule.

Generated by OpenCVE AI on September 2, 2026 at 07:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 06:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access to DMZ Configuration via Crafted POST Request in TOTOLINK T6 Firmware
Weaknesses CWE-200

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access to DMZ Configuration via Crafted POST Request in TOTOLINK T6 Firmware
First Time appeared Totolink
Totolink t6
Weaknesses CWE-200
CWE-284
Vendors & Products Totolink
Totolink t6

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink T6
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-01T16:11:23.962Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51659

cve-icon Vulnrichment

Updated: 2026-09-01T16:11:19.542Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T20:18:09.497

Modified: 2026-09-01T17:17:29.970

Link: CVE-2026-51659

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T08:00:14Z

Weaknesses