Description

Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose internal services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T15:17:21.367Z",
  "pubdate": "2026-08-31T15:17:21.367Z",
  "executiveSummary": "The TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 contains an improper access control vulnerability within its web management interface.\nSpecifically, the setPortForwardRules function fails to properly validate the authentication status of incoming requests.\nThis flaw allows unauthenticated remote attackers to manipulate port forwarding configurations by submitting a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.\nSuccessful exploitation enables unauthorized actors to expose internal network services to the public internet, potentially bypassing perimeter defenses.\nThe vulnerability represents a significant security risk, as it permits attackers to circumvent authentication mechanisms to reconfigure device network policies without prior system access or valid credentials.",
  "technicalDetails": "The vulnerability resides within the cstecgi.cgi Common Gateway Interface (CGI) handler, which processes administrative commands for the device.\nThe root cause is an improper authorization check in the setPortForwardRules function, which is responsible for modifying the device's port forwarding table.\nWhile administrative actions typically mandate session validation, the implementation of this specific function fails to enforce these checks, allowing the underlying logic to execute regardless of the user's authentication state.\nThe attack flow begins with an attacker sending a maliciously crafted HTTP POST request directed at /cgi-bin/cstecgi.cgi.\nBy manipulating the request parameters to invoke the setPortForwardRules command, the attacker can inject arbitrary port forwarding rules into the device configuration.\nBecause the function lacks an authentication guard, the binary processes these parameters as legitimate administrative requests, updating the routing table immediately upon receipt.\nThis allows an attacker to map internal services—such as SSH, RDP, or web administration panels—to external-facing ports on the WAN interface.\nThe impact of this vulnerability is critical, as it facilitates unauthorized exposure of internal network resources, potentially leading to further reconnaissance or direct service exploitation by the attacker.\nThe lack of integrity or authorization validation for these POST parameters means the device acts as a proxy for the attacker's configuration changes, bypassing the intended security posture of the TOTOLINK T6 device.\nThe exploit does not require any prior knowledge of the administrator's credentials or established session tokens, making it trivial to execute for any attacker with network reachability to the web interface."
}