Description
Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Published: 2026-08-31
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Deletion of Traceroute Logs
Action: Patch
AI Analysis

Impact

An incorrect access control check in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi trigger the clearTracerouteLog function. This function erases the device’s traceroute logs, removing valuable forensic evidence and hindering troubleshooting without affecting device configurations or network connectivity.

Affected Systems

This flaw targets TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015. No other vendors or product lines are mentioned in the advisory as affected.

Risk and Exploitability

The vulnerability is exploitable remotely via an unauthenticated HTTP POST. EPSS is less than 1% and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 5.3 indicates moderate severity, and the lack of an authentication barrier combined with the ability to delete logs poses a notable operational risk for environments that rely on audit trails.

Generated by OpenCVE AI on September 2, 2026 at 05:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest TOTOLINK firmware update that addresses the clearTracerouteLog access control flaw if one is available.
  • Configure firewall or router access controls to restrict POST traffic to /cgi-bin/cstecgi.cgi to trusted IP addresses, or disable the clearTracerouteLog functionality if such an option exists.
  • Regularly back up traceroute logs and monitor for unexpected deletions to maintain traceability.

Generated by OpenCVE AI on September 2, 2026 at 05:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access Allows Erasure of Traceroute Logs via ClearTracerouteLog Function in TOTOLINK T6 4.1.5cu.748_B20211015

Tue, 01 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access Allows Erasure of Traceroute Logs via ClearTracerouteLog Function in TOTOLINK T6 4.1.5cu.748_B20211015

Mon, 31 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink t6
Vendors & Products Totolink
Totolink t6

Mon, 31 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink T6
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-01T14:51:44.807Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51737

cve-icon Vulnrichment

Updated: 2026-09-01T14:50:33.696Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T20:17:04.990

Modified: 2026-09-01T15:17:19.603

Link: CVE-2026-51737

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T05:15:05Z

Weaknesses