Description

Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to query slave upgrade status and affect upgrade bookkeeping via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T14:17:14.533Z",
  "pubdate": "2026-08-31T14:17:14.533Z",
  "executiveSummary": "The TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 contains an improper access control vulnerability within the getSlaveUpdate function located in the cgi-bin handler.\nThis vulnerability allows unauthenticated remote attackers to interact with sensitive firmware upgrade processes by sending crafted POST requests to /cgi-bin/cstecgi.cgi.\nThe primary risk involves the unauthorized exposure of internal slave device upgrade statuses and the potential for an attacker to manipulate or corrupt firmware upgrade bookkeeping mechanisms.\nAs the interface lacks proper authentication verification, it is susceptible to exploitation over the network by any unprivileged actor capable of reaching the device's web management interface.\nThe exploitability of this flaw places the integrity of the device's update lifecycle at risk, potentially leading to denial-of-service conditions regarding system updates or facilitating further reconnaissance against the device infrastructure.",
  "technicalDetails": "The vulnerability originates from an incorrect implementation of authentication checks within the getSlaveUpdate function, which is exposed via the /cgi-bin/cstecgi.cgi gateway. The cstecgi.cgi component serves as a centralized dispatcher for various administrative functions on the TOTOLINK T6 device. During the execution flow of the getSlaveUpdate function, the application fails to validate the session state or credentials of the requesting user before processing the request payload.\nExploitation is achieved by transmitting a specifically crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint. By targeting the getSlaveUpdate logic, an attacker can bypass traditional security controls that should restrict access to sensitive system management operations. Since the function is designed to handle internal communications between the master device and slave nodes regarding firmware versioning and update readiness, the lack of session validation allows an external party to interact directly with these internal primitives.\nThe attack flow follows a structured sequence: First, the attacker identifies the web service listening on the device's management port. Second, the attacker crafts a POST request that triggers the getSlaveUpdate action. Because the server-side code does not implement an authorization gate or verify the presence of a valid administrative session cookie, the function proceeds to execute its internal routine. This routine, which interacts with the system's firmware upgrade bookkeeping variables, is forced to disclose sensitive state information or perform state transitions based on the attacker's controlled input.\nThe root cause is a failure in the application's request dispatching logic, which prioritizes function execution without enforcing security policy enforcement points (PEP). By manipulating the payload of the request, an attacker can effectively influence how the device tracks slave upgrade status. This can lead to the corruption of the upgrade management state, potentially tricking the system into entering an invalid upgrade state, causing the device to reject valid firmware updates, or exposing telemetry about the internal mesh configuration to an unauthorized entity. The scope of impact is confined to the device's internal firmware management process but poses a significant security risk for maintaining the device's long-term firmware integrity and availability."
}