Description

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T14:17:14.873Z",
  "pubdate": "2026-08-31T14:17:14.873Z",
  "executiveSummary": "The TOTOLINK T6 router, specifically firmware version 4.1.5cu.748_B20211015, contains a critical access control vulnerability located within the cgi-bin environment.\nThis vulnerability is classified as an improper access control flaw, allowing unauthorized, unauthenticated network actors to query sensitive configuration parameters.\nThe vulnerability manifests within the getRoamingCfg function, which fails to enforce session validation or authentication checks before processing requests.\nBy sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, an attacker can extract the roaming enablement flag.\nThis exposure of internal configuration state poses a significant security risk, as it bypasses intended administrative security boundaries and grants an unauthenticated entity visibility into the device's functional configuration.\nThe attack requires no prior authentication, lowering the barrier for exploitation and potentially facilitating reconnaissance activities for more complex or chained attacks against the infrastructure.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure implementation of the getRoamingCfg function within the TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The system utilizes /cgi-bin/cstecgi.cgi as a centralized interface for handling web-based administrative tasks and configuration requests.\nThe architectural flaw is characterized by the absence of an authorization check or session verification mechanism prior to the execution of the getRoamingCfg logic. Under standard secure design principles, administrative functions exposed via CGI interfaces must validate the requester's session token or administrative privilege level before processing inputs or returning configuration states. In this instance, the function assumes implicit trust in any request routed to it.\nThe attack flow follows a straightforward pattern: The attacker constructs a POST request directed at the /cgi-bin/cstecgi.cgi endpoint. The request payload is designed to invoke the getRoamingCfg function, which the backend CGI handler processes without secondary validation. Upon receipt, the function retrieves the current state of the roaming enablement flag from the system configuration file or memory. This information is subsequently returned in the HTTP response body to the attacker.\nThis behavior represents a failure in the application's access control enforcement, specifically regarding the exposure of backend functional routines. Because the vulnerability resides at the intersection of the web server's routing logic and the specific function implementation, it circumvents the device's administrative login page entirely.\nThe impact of this exploit is primarily information disclosure. By obtaining the roaming enablement flag, an attacker gains insight into the device's network roaming configuration, which can be leveraged for further network mapping or to identify specific deployment environments that may be susceptible to further exploitation if the roaming feature is enabled or disabled in a specific, attacker-preferred manner. Because the attack is unauthenticated and requires minimal interaction, the exposure is considered a significant breach of the intended device security posture and local network integrity."
}