Description
Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Published: 2026-08-31
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized termination of critical services
Action: Immediate Remediation
AI Analysis

Impact

Incorrect access control in the killProcess function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 permits any network user to craft a POST request to /cgi-bin/cstecgi.cgi and terminate essential services, resulting in loss of availability for those services. The flaw does not provide code execution or data exfiltration capabilities, but it can be used to disrupt services on the device.

Affected Systems

The vulnerability affects TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015. No other versions or vendors are documented as impacted.

Risk and Exploitability

The CVSS score of 9.8, combined with an EPSS score of less than 1%, indicates a high‑severity vulnerability that is unlikely to be actively exploited. Nevertheless, the lack of authentication allows an attacker on the same network to terminate services at any time. The flaw is not listed in the CISA KEV catalog; its simplicity means it could be abused to cause denial of service in targeted attacks. No public exploit has been reported.

Generated by OpenCVE AI on September 1, 2026 at 17:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update that removes the unauthenticated killProcess endpoint.
  • If a firmware update is not yet available, block or deny traffic to /cgi-bin/cstecgi.cgi using network firewall rules or router access control.
  • If the firmware allows it, disable or remove the killProcess functionality from the router configuration.
  • Monitor router logs for unexpected POST attempts to cgi-bin endpoints and investigate anomalies.

Generated by OpenCVE AI on September 1, 2026 at 17:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access Control Flaw Enables Process Termination in TOTOLINK T6 Router

Tue, 01 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink t6
Vendors & Products Totolink
Totolink t6

Mon, 31 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access Control Flaw Enables Process Termination in TOTOLINK T6 Router
Weaknesses CWE-284

Mon, 31 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink T6
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-01T13:55:18.537Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51740

cve-icon Vulnrichment

Updated: 2026-09-01T13:55:15.532Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T20:17:05.320

Modified: 2026-09-01T14:17:34.593

Link: CVE-2026-51740

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T17:30:17Z

Weaknesses