Description

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T14:17:16.027Z",
  "pubdate": "2026-08-31T14:17:16.027Z",
  "executiveSummary": "The TOTOLINK T6 router, specifically firmware version 4.1.5cu.748_B20211015, contains a critical vulnerability regarding insufficient access control within its administrative management interface.\nThe vulnerability stems from the improper implementation of authentication checks within the setPasswordCfg function, which handles administrative credential modifications.\nThis security flaw allows an unauthenticated, remote attacker to bypass standard security controls and modify the administrator account password.\nBy successfully exploiting this vulnerability, an attacker gains unauthorized control over the device settings, effectively seizing administrative privileges.\nThis impact poses a severe risk to the confidentiality, integrity, and availability of the networking infrastructure governed by the device.\nThe exploitation process does not require prior authentication, making the device highly susceptible to attackers with network access to the target system.\nThe vulnerability highlights a significant failure in session management and authorization validation for sensitive configuration routines.",
  "technicalDetails": "The vulnerability is located in the setPasswordCfg function within the cgi-bin binary, which is invoked via the /cgi-bin/cstecgi.cgi endpoint.\nAnalysis of the firmware indicates that the routine responsible for processing password updates fails to verify the session state or the current authentication context of the requesting user.\nIn a secure configuration, the web server interface should perform an authorization check to ensure the request originates from an active, authenticated administrator session before executing any configuration changes.\nThe exploitation flow begins with the attacker crafting a specific HTTP POST request directed at the /cgi-bin/cstecgi.cgi path. Because the underlying logic in setPasswordCfg does not implement mandatory access control checks, it blindly processes the parameters provided in the request body.\nAn attacker can supply malicious payloads containing updated credentials for the administrative account, which the function proceeds to apply to the device's configuration database.\nSince the request does not require any session tokens or legitimate administrative cookies, the attack can be executed from a network-adjacent position or via any interface exposed to the public internet.\nThe successful execution of this request effectively overwrites the existing administrative password, allowing the attacker to establish a persistent, unauthorized management session.\nOnce the administrator account is compromised, the attacker can leverage further administrative functions to install malicious firmware, modify network routing tables, intercept sensitive traffic, or disable device security features entirely, leading to a complete compromise of the router.\nThe absence of a robust authentication middleware layer protecting the cstecgi.cgi interface constitutes the primary root cause of this vulnerability, allowing functions that handle sensitive configuration changes to be exposed to unauthenticated users."
}