Description
Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Published: 2026-08-31
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unprivileged Configuration Change
Action: Apply Firmware Update
AI Analysis

Impact

The vulnerability resides in the setWanCfg function of the TOTOLINK T6 firmware, where incorrect access control allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi and modify upstream provisioning and connectivity settings. This flaw can result in remote alteration of WAN configurations, potentially causing service disruption or redirecting traffic to malicious endpoints, thereby compromising network availability and potentially exposing sensitive data to unintended parties.

Affected Systems

The flaw affects TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015.

Risk and Exploitability

The CVSS score of 9.1 indicates critical severity. EPSS is below 1%, suggesting low but nonzero exploitation probability. The flaw is not listed in the CISA KEV catalog, but the lack of authentication requirement presents a high risk for remote attackers. The likely attack vector is network-based; an attacker can send a crafted HTTP POST to /cgi-bin/cstecgi.cgi without credentials. The impact allows remote alteration of WAN configurations, potentially causing service disruption or redirecting traffic to malicious endpoints.

Generated by OpenCVE AI on September 3, 2026 at 14:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware release from TOTOLINK that contains a fix for the incorrect access control in setWanCfg.
  • Configure the router’s firewall or ACLs to block or restrict access to /cgi-bin/cstecgi.cgi from untrusted networks.
  • If possible, disable remote management or limit administrative access to trusted IP addresses to prevent unauthenticated requests.

Generated by OpenCVE AI on September 3, 2026 at 14:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access Control Failure in TOTOLINK T6 Router’s WAN Configuration

Wed, 02 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Mon, 31 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access Control Failure in TOTOLINK T6 Router’s WAN Configuration
First Time appeared Totolink
Totolink t6
Weaknesses CWE-284
Vendors & Products Totolink
Totolink t6

Mon, 31 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink T6
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-02T16:03:33.085Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51690

cve-icon Vulnrichment

Updated: 2026-09-02T14:33:52.742Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T15:17:20.550

Modified: 2026-09-02T16:17:16.340

Link: CVE-2026-51690

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T14:30:05Z

Weaknesses