Description

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T14:17:14.717Z",
  "pubdate": "2026-08-31T14:17:14.717Z",
  "executiveSummary": "This vulnerability is an Improper Access Control flaw within the TOTOLINK T6 firmware (version 4.1.5cu.748_B20211015). The vulnerability resides in the getCloudDownloadStatus function, which fails to enforce authentication checks for incoming requests.\nBy sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, an unauthenticated, remote attacker can successfully trigger this function and retrieve sensitive information regarding the cloud firmware download state.\nThe risk implication involves unauthorized information disclosure of internal system states, which could be leveraged to gain reconnaissance or facilitate further exploitation of the device's firmware management processes.\nExploitation requires no prior authentication or administrative privileges, making it accessible to any attacker with network connectivity to the device's web management interface.",
  "technicalDetails": "The vulnerability is localized within the /cgi-bin/cstecgi.cgi script of the TOTOLINK T6 device. The root cause is an insecure implementation of access control logic within the getCloudDownloadStatus function handler, which processes requests for system status updates related to firmware operations.\nThe cstecgi.cgi binary is responsible for routing CGI (Common Gateway Interface) requests to internal functions. In the affected version, the getCloudDownloadStatus function lacks the necessary session validation or privilege checking mechanism that is typically expected to guard sensitive internal status queries.\nThe exploitation process follows a straightforward attack flow: An unauthenticated attacker initiates an HTTP POST request targeting the /cgi-bin/cstecgi.cgi endpoint. The request must be crafted with the appropriate parameters that signal the backend logic to execute the getCloudDownloadStatus function.\nUpon receiving the request, the application routes the input directly to the vulnerable function without verifying the requester's identity. The backend processes the request and returns the requested firmware download status information directly to the HTTP response body. This output may reveal details such as the status of cloud synchronization, ongoing firmware download progress, or internal state flags used by the device management system.\nBecause the function does not validate user sessions, the network exposure is equal to the exposure of the administrative interface itself. If the web management portal is accessible over the WAN or a compromised LAN, an attacker can extract this state information remotely. The payload behavior is strictly focused on unauthorized information retrieval rather than remote code execution (RCE) via this specific function; however, the disclosure of these internal states provides actionable intelligence that could be used to identify timing windows for other attacks or to bypass security measures dependent on cloud service state synchronization."
}