Description

Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T14:17:15.527Z",
  "pubdate": "2026-08-31T14:17:15.527Z",
  "executiveSummary": "The TOTOLINK T6 router, specifically firmware version 4.1.5cu.748_B20211015, contains a critical incorrect access control vulnerability within its web management interface.\nThe vulnerability resides in the setAccessDeviceCfg function, which fails to properly validate the authentication state of incoming requests.\nThis security flaw enables unauthenticated, remote attackers to arbitrarily modify access-device policies on the device.\nBy manipulating these configurations, an attacker can effectively bypass security restrictions, manage network access controls, or potentially facilitate further lateral movement within the network.\nThe requirement for exploitation is minimal, as it does not necessitate prior authentication, exposing the device to any actor with network visibility to the management interface.\nThis poses a significant risk to the integrity and security posture of the router, as the ability to alter access policies is a core administrative function that should be strictly protected.",
  "technicalDetails": "The vulnerability is identified as an Improper Access Control flaw within the CGI binary handling the device's administrative configuration. The affected component is the setAccessDeviceCfg function, which is exposed via the /cgi-bin/cstecgi.cgi endpoint.\nRoot Cause: The root cause of this vulnerability is the absence of an authorization check or session validation logic within the setAccessDeviceCfg function. While the system expects administrative intervention to modify device access policies, the implementation fails to verify if the request originating from the web client is accompanied by a valid, authenticated session cookie or authorized token.\nExploitation Method: An attacker can exploit this by crafting a malicious POST request directed at the /cgi-bin/cstecgi.cgi endpoint. By defining the appropriate function parameters in the request body, the attacker forces the backend logic to execute the setAccessDeviceCfg function. Because the function lacks the necessary access control checks, the device processes the request as if it were issued by an authorized administrator.\nAttack Flow: 1. The attacker identifies the target IP of the TOTOLINK T6 device. 2. The attacker constructs a HTTP POST request targeting /cgi-bin/cstecgi.cgi. 3. The request payload includes the parameters intended for the setAccessDeviceCfg function, allowing the attacker to redefine access-device policies. 4. The web server passes the request to the CGI interface. 5. The vulnerable function executes the requested configuration changes without verifying the user's credentials or session state. 6. The device updates its policy configuration accordingly.\nAffected Versions: TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 is explicitly identified as vulnerable.\nPrivilege and Authentication: The vulnerability requires no authentication and no specific privilege level, allowing any unauthenticated remote user to alter core device policies. The exposure is limited only by network reachability to the CGI interface.\nImpact: Successful exploitation results in the unauthorized modification of device access-device policies. This can lead to the disabling of security blocks, unauthorized modification of firewall-like rules, or the potential re-configuration of device permissions, thereby compromising the security boundary managed by the router."
}