Description

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T14:17:16.180Z",
  "pubdate": "2026-08-31T14:17:16.180Z",
  "executiveSummary": "The TOTOLINK T6 router (version 4.1.5cu.748_B20211015) suffers from an improper access control vulnerability located in the setLedCfg function. This security flaw allows unauthenticated remote attackers to modify the device's LED configuration by dispatching a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.\nThis vulnerability stems from the absence of robust authentication and authorization checks within the handler for the setLedCfg command. By successfully exploiting this weakness, an attacker can manipulate hardware behavior, potentially serving as a precursor to more complex attacks or causing functional disruption to the device.\nThe risk implication is significant as it demonstrates a failure in the device's administrative boundary enforcement. Exploitation does not require prior user credentials, meaning any entity with network connectivity to the device's web management interface can trigger the unauthorized state change. This highlights a critical need for rigorous session validation and input sanitization across the CGI interface.",
  "technicalDetails": "The vulnerability resides within the cgi-bin handler, specifically /cgi-bin/cstecgi.cgi, which processes administrative commands for the TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The core issue is an authorization bypass mechanism where the setLedCfg function does not verify the requester's session integrity or administrative privileges before processing configuration change requests.\nThe attack flow begins when an attacker identifies the target endpoint, /cgi-bin/cstecgi.cgi, which acts as a gateway for internal configuration parameters. Under normal operational conditions, this interface is intended to be protected by an authentication layer; however, the setLedCfg function fails to enforce this requirement. An unauthenticated attacker can construct a POST request containing specific JSON or form-encoded payloads targeting the LED configuration subsystem. Upon receipt, the backend handler executes the setLedCfg routine without validating the request origin.\nThe root cause is a failure in the command dispatcher's logic, which permits access to sensitive internal functions via the CGI gateway without validating authentication tokens or session cookies. Since the application logic assumes that all calls to this subsystem are authorized by virtue of reaching the CGI handler, it treats the untrusted user input as a legitimate administrative command.\nThe exploitation method involves crafting a malicious POST request that maps to the internal setLedCfg parameters. An attacker can manipulate the LED behavior—such as forcing the device into a specific visual state, which could be used for silent signaling, obfuscation of activity, or denial-of-service conditions by disabling status indicators to mask unauthorized access. Because the target is a network-facing management interface, the exploit is highly accessible to any adversary with visibility into the device's administration network. The post-exploitation impact includes the loss of device management integrity and the potential for a lateral pivot, as the vulnerability indicates that other configuration functions under the same CGI path may share similar authorization bypass flaws."
}