Description

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T14:17:14.200Z",
  "pubdate": "2026-08-31T14:17:14.200Z",
  "executiveSummary": "The TOTOLINK T6 router, specifically firmware version 4.1.5cu.748_B20211015, contains a critical access control vulnerability within its web management interface.\nThe flaw manifests as an Improper Access Control vulnerability, allowing an unauthenticated remote attacker to interact with the setLanguageCfg function.\nSuccessful exploitation permits unauthorized modification of the device's language configuration.\nThis vulnerability poses a significant security risk, as it demonstrates a failure in the authentication middleware protecting sensitive administrative functions.\nAttackers can leverage this bypass by sending a crafted HTTP POST request directly to the cstecgi.cgi endpoint without prior authentication.\nThe primary risk involves the unauthorized manipulation of system settings, which may serve as a precursor to more severe administrative compromise or act as an indicator of an insecure API design that may harbor further undocumented functional access points.\nGiven the nature of the vulnerability, the attack surface is exposed to any actor with network reach to the device's web management interface.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper implementation of session validation and access control logic within the cstecgi.cgi binary, specifically targeting the setLanguageCfg function.\nIn the TOTOLINK T6 4.1.5cu.748_B20211015 firmware, the web management interface utilizes a centralized gateway, /cgi-bin/cstecgi.cgi, to handle various administrative actions through POST requests.\nDuring the processing of requests, the application fails to verify the existence or validity of an active administrative session before executing the internal logic associated with the setLanguageCfg function.\nAn attacker can exploit this flaw by constructing a malformed or specific HTTP POST request directed at /cgi-bin/cstecgi.cgi. By including the appropriate parameters required by the setLanguageCfg function, the request bypasses the expected authentication check and forces the underlying system to update the language configuration variables stored in the device's non-volatile memory.\nThe attack flow begins with the attacker identifying the target endpoint on the network. Once the target is reached, the attacker does not need to provide valid credentials or a session token. Instead, the attacker transmits a crafted POST payload designed to trigger the vulnerable function. The device's web server process, upon receiving this request, fails to perform an authorization handshake, directly passing the command to the setLanguageCfg routine.\nBecause the function is executed with the privileges of the web server process, it modifies the system-level configuration files without verifying the originator's identity. This indicates that the authentication mechanism is likely a wrapper that is not strictly enforced for every exported CGI function, creating a 'broken access control' condition.\nThe post-exploitation impact includes the persistent modification of system settings. While language modification may seem benign, the ability to successfully execute administrative-level commands without authentication suggests that the cstecgi.cgi interface lacks comprehensive security controls, potentially exposing other, more critical functions to similar unauthenticated access. This lack of architectural rigor in the request handler makes the device highly susceptible to unauthorized configuration changes, which could be chained with other vulnerabilities to facilitate full device takeover or denial-of-service conditions."
}