Description

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T14:17:15.360Z",
  "pubdate": "2026-08-31T14:17:15.360Z",
  "executiveSummary": "The TOTOLINK T6 router (firmware version 4.1.5cu.748_B20211015) suffers from an incorrect access control vulnerability within its web-based management interface. This flaw resides in the 'setWanIeCfg' function, which fails to adequately validate the session state or authentication status of incoming requests.\nThe vulnerability allows remote, unauthenticated attackers to manipulate critical device configuration settings, specifically those related to WAN uplink parameters. By crafting and submitting a malicious POST request to the '/cgi-bin/cstecgi.cgi' endpoint, an attacker can override existing network settings without legitimate administrative credentials.\nThe risk implication is critical, as unauthorized modifications to WAN settings can lead to man-in-the-middle attacks, traffic redirection, denial-of-service, or complete bypass of perimeter security controls. Since the vulnerability is accessible to unauthenticated entities over the network, it poses a significant threat to internal network integrity and overall system security.\nExploitation requires no prior authentication, making the device highly susceptible to automated exploitation attempts from any network entity capable of reaching the web management interface.",
  "technicalDetails": "The vulnerability is localized within the 'setWanIeCfg' function, which is exposed via the '/cgi-bin/cstecgi.cgi' common gateway interface handler. The root cause of this security flaw is the absence of a mandatory session-check mechanism or authentication filter for this specific function call, allowing the CGI backend to process configuration update requests from unauthenticated clients.\nThe attack flow begins when an attacker identifies the target TOTOLINK T6 device and determines the reachable '/cgi-bin/cstecgi.cgi' endpoint. The attacker then constructs a crafted POST request containing specific parameters intended for the 'setWanIeCfg' function. Because the underlying logic does not verify the presence of a valid management session cookie or a session token, the application processes the POST body as a legitimate request from an authenticated user.\nUpon receiving the malicious request, the 'setWanIeCfg' function parses the parameters to update the router's WAN interface configuration. An attacker can inject arbitrary values into these fields, effectively reconfiguring the gateway's internet connectivity settings. This allows an attacker to alter DNS settings to point to a malicious server, change static IP assignments, or modify PPPoE/DHCP credentials.\nThe post-exploitation impact is severe, as the integrity of the network traffic flow is compromised. By forcing the router to use a malicious WAN configuration, an attacker can perform traffic interception, inspection, or manipulation. This provides a platform for executing sophisticated network-level attacks, such as DNS hijacking, which redirects users to fraudulent sites while appearing to originate from legitimate domains. Furthermore, the attacker could effectively isolate the device from the legitimate ISP gateway, resulting in a persistent denial-of-service condition for all connected clients.\nThe vulnerability persists due to a failure in the application's request pipeline, where sensitive configuration functions are not isolated behind the administrative authentication layer. This indicates a broader design flaw in how the CGI interface implements access control across different management modules."
}