Description

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T15:17:21.483Z",
  "pubdate": "2026-08-31T15:17:21.483Z",
  "executiveSummary": "The TOTOLINK T6 router, specifically version 4.1.5cu.748_B20211015, contains a critical access control vulnerability located within the setIptvCfg function.\nThis vulnerability is categorized as an improper access control flaw, which permits unauthenticated remote attackers to modify IPTV service configurations without valid credentials.\nThe attack vector involves sending a maliciously crafted POST request to the cgi-bin/cstecgi.cgi interface, which acts as the command and control gateway for administrative functions.\nSuccessful exploitation allows an adversary to manipulate network configuration parameters, potentially leading to unauthorized service disruption, traffic redirection, or man-in-the-middle conditions.\nThis vulnerability is particularly severe as it requires no prior authentication, lowering the barrier to entry for attackers on the local network or those able to reach the device management interface.\nThe risk implication is high, as it grants unauthorized actors control over the router's IPTV stack, facilitating persistence or configuration tampering.",
  "technicalDetails": "The vulnerability originates from a failure to enforce authentication checks or session validation within the setIptvCfg function, which is exposed via the cgi-bin/cstecgi.cgi script.\nIn the firmware version 4.1.5cu.748_B20211015, the web management interface routes various configuration requests through a CGI (Common Gateway Interface) handler. This handler fails to verify the identity of the requester before passing parameters to the internal setIptvCfg logic.\nThe attack flow commences when an unauthenticated attacker transmits a specifically formatted HTTP POST request to /cgi-bin/cstecgi.cgi. The request body contains parameters intended for the setIptvCfg function, which the application backend processes as legitimate administrative instructions.\nBecause the function lacks an authorization gate, it processes these inputs and overwrites the existing configuration files stored in the device's non-volatile memory.\nStep-by-step exploitation involves: 1) The attacker identifies the endpoint /cgi-bin/cstecgi.cgi as the target for configuration-related actions. 2) The attacker crafts a POST payload that includes parameters defined by the setIptvCfg function. 3) The request is transmitted over the network (typically via the local area network or reachable management interfaces). 4) The server-side CGI script receives the payload and invokes the underlying C-based function, setIptvCfg. 5) The function updates the IPTV configuration parameters without verifying the user's session or administrative privilege level.\nThe impact of this vulnerability is significant, as it permits unauthorized manipulation of critical system services. By altering the IPTV settings, an attacker could potentially influence traffic routing, bypass network isolation mechanisms, or induce a Denial of Service (DoS) state by supplying invalid or malicious configuration values that crash or misconfigure the service logic. The vulnerability is fundamentally rooted in the missing authentication mechanism during the execution of administrative configuration procedures, which should be protected by standard session-based access control."
}