Description
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Published: 2026-08-31
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Configuration Change
Action: Update Firmware
AI Analysis

Impact

The vulnerability is an incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can craft a POST request to /cgi-bin/cstecgi.cgi and remove firewall filter rules, undermining the device’s security policy. This loss of integrity could allow malicious traffic to bypass the router’s firewall protection.

Affected Systems

The affected product is the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. No other vendors or products are listed.

Risk and Exploitability

The flaw can be exploited remotely without authentication, meaning any device reachable on the network is exposed. Although EPSS data are unavailable and the vulnerability is not listed in the KEV catalog, the lack of authentication required suggests a high likelihood of exploitation once a router is online. The CVSS score of 9.1 indicates a high severity problem, confirming the potential impact of the flaw.

Generated by OpenCVE AI on August 31, 2026 at 20:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a firmware update that patches the delIpPortFilterRules access control.
  • Restrict access to the /cgi-bin/cstecgi.cgi interface by limiting it to trusted internal IP ranges or disabling the web management interface if not needed.
  • Regularly audit firewall rules and monitor logs for unauthorized POST requests to the CGI endpoint.

Generated by OpenCVE AI on August 31, 2026 at 20:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Removal of Firewall Rules via delIpPortFilterRules in TOTOLINK T6

Mon, 31 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Mon, 31 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Removal of Firewall Rules via delIpPortFilterRules in TOTOLINK T6
Weaknesses CWE-284

Mon, 31 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink t6
Vendors & Products Totolink
Totolink t6

Mon, 31 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink T6
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-31T18:58:30.545Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51720

cve-icon Vulnrichment

Updated: 2026-08-31T18:57:20.526Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T17:17:41.523

Modified: 2026-08-31T20:59:32.817

Link: CVE-2026-51720

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T21:00:05Z

Weaknesses