Description

Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T16:18:35.260Z",
  "pubdate": "2026-08-31T16:18:35.260Z",
  "executiveSummary": "The TOTOLINK T6 router (version 4.1.5cu.748_B20211015) suffers from an improper access control vulnerability located within the setMacFilterRules function.\nThis security flaw allows unauthenticated remote attackers to modify the device's MAC address filtering configuration, a critical component of the router's internal security perimeter.\nThe vulnerability resides in the CGI interface (/cgi-bin/cstecgi.cgi), which fails to enforce session validation or authorization checks prior to processing administrative requests.\nBy bypassing authentication, an attacker gains unauthorized control over the device's access control lists (ACLs).\nThe primary risk implications include the ability for malicious actors to whitelist unauthorized MAC addresses or blacklist legitimate users, effectively facilitating unauthorized network access or causing denial of service.\nExploitation requires no prior authentication and can be executed over the network by sending a crafted POST request to the targeted endpoint.\nThis vulnerability highlights a critical failure in the device's request handling logic where sensitive configuration changes are exposed without adequate verification of the requester's identity or authorization privileges.",
  "technicalDetails": "The vulnerability is rooted in an insecure implementation of the setMacFilterRules function within the firmware of the TOTOLINK T6 (version 4.1.5cu.748_B20211015).\nThis function is exposed via the /cgi-bin/cstecgi.cgi Common Gateway Interface (CGI) handler, which serves as a primary interface for administrative actions.\nThe root cause of this vulnerability is the absence of an authentication check or a session-based access control mechanism within the setMacFilterRules routine.\nUnder normal operating conditions, administrative functions should necessitate a valid, cryptographically secure session token or established administrative authentication; however, the cstecgi.cgi interface processes incoming POST requests without verifying the user's privilege level.\nThe attack flow proceeds as follows: 1. The attacker crafts a malicious HTTP POST request targeted at /cgi-bin/cstecgi.cgi. 2. The request payload is specifically formatted to invoke the setMacFilterRules function with attacker-supplied parameters meant to alter the device’s MAC filtering configuration. 3. The web server process receives the request and parses the CGI parameters. 4. The firmware executes the setMacFilterRules function with the provided data without challenging the attacker for credentials. 5. The device's internal state is updated, applying the modified MAC rules immediately.\nBecause the function does not validate the integrity or the provenance of the request, an unauthenticated user on the local area network (or potentially exposed wide area network, depending on configuration) can redefine access constraints.\nThe payload behavior involves manipulating the internal data structures that govern MAC filtering. By modifying these structures, an attacker can effectively bypass intended ingress/egress filtering rules.\nThe post-exploitation impact includes persistent changes to the device security configuration, allowing the attacker to evade security policies. This could permit unauthorized clients to gain network access or facilitate man-in-the-middle attacks by routing traffic through specific MAC-whitelisted endpoints.\nThe vulnerability is specifically isolated to the cstecgi.cgi handler’s lack of input validation and session enforcement. The device architecture fails to apply the 'principle of least privilege' at the application layer, treating administrative commands as untrusted inputs that lack any form of robust gatekeeping."
}