Description

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T16:18:35.037Z",
  "pubdate": "2026-08-31T16:18:35.037Z",
  "executiveSummary": "The TOTOLINK T6 router, specifically firmware version 4.1.5cu.748_B20211015, contains a critical incorrect access control vulnerability within the setDmzCfg function.\nThis security flaw allows unauthenticated remote attackers to bypass authorization mechanisms and modify the Demilitarized Zone (DMZ) configuration by submitting a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.\nBy manipulating the DMZ settings, an attacker can expose an internal network host directly to the public internet, effectively neutralizing the firewall's perimeter security for that specific device.\nThe vulnerability represents a significant risk to network integrity, as it facilitates the bypass of NAT-based protection, potentially exposing vulnerable internal services to unsolicited inbound traffic and exploitation by external malicious actors.\nExploitation requires no prior authentication or administrative privileges, making this an accessible entry point for network reconnaissance and targeted attacks against internal infrastructure.",
  "technicalDetails": "The vulnerability resides in the web management interface of the TOTOLINK T6, specifically within the logic processing the /cgi-bin/cstecgi.cgi endpoint. The root cause is an improper implementation of access control checks within the setDmzCfg function, which fails to verify the session validity or authentication status of the incoming request.\nWhen the web server receives a POST request directed at the cstecgi.cgi handler, it routes the request to the setDmzCfg function. Under normal operational security expectations, this function should restrict access to authenticated administrative sessions. However, in version 4.1.5cu.748_B20211015, the function lacks the necessary conditional checks to validate if the requester is an authorized administrator.\nThe attack flow involves the following steps: First, an unauthenticated attacker identifies the target device's management interface, which is typically reachable via the local network or, if misconfigured, the WAN interface. Second, the attacker constructs a crafted HTTP POST request targeting /cgi-bin/cstecgi.cgi. This payload includes parameters designed to interface with the setDmzCfg function, allowing the attacker to specify an internal IP address to be assigned as the DMZ host.\nUpon receipt, the cstecgi.cgi handler invokes setDmzCfg without validating the request's origin or authorization token. The function proceeds to update the internal configuration files to reflect the new DMZ host. Once the configuration is committed, the router's iptables or equivalent firewall rules are modified to forward all external traffic (not matching other port forwarding rules) to the specified internal host.\nThe impact of this exploitation is a complete breach of the internal perimeter for the targeted host. By exposing an internal IP address, the attacker effectively renders the internal host's services (such as SSH, RDP, or unpatched web applications) reachable from the internet. This provides an attacker with the ability to conduct further exploitation, such as lateral movement or data exfiltration, by bypassing the NAT layer that previously protected the internal asset. The lack of authentication requirements allows this to be scripted for automated reconnaissance or mass exploitation campaigns targeting TOTOLINK firmware."
}