Description

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T16:18:36.010Z",
  "pubdate": "2026-08-31T16:18:36.010Z",
  "executiveSummary": "A critical access control vulnerability exists in the TOTOLINK T6 router, specifically within the setWiFiBasicCfg function. The vulnerability allows remote, unauthenticated attackers to modify primary Wi-Fi configuration parameters by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.\nThe core of the issue lies in improper authorization checks, enabling unauthorized entities to bypass security controls and alter critical network settings. By exploiting this flaw, an attacker can manipulate the wireless interface, potentially leading to unauthorized network access, denial of service through misconfiguration, or man-in-the-middle attacks.\nThe vulnerability affects TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015. Given that the device does not require authentication for the vulnerable request, the attack surface is exposed to any actor with network visibility to the device's management interface. This poses significant risk to the confidentiality, integrity, and availability of the wireless network managed by the affected device.",
  "technicalDetails": "The vulnerability resides within the setWiFiBasicCfg function, which is responsible for processing administrative requests related to the device's wireless network parameters. Analysis indicates that the CGI binary responsible for handling requests to /cgi-bin/cstecgi.cgi fails to perform adequate session validation or authentication checks before invoking this function.\nThe root cause is a failure in the authorization logic, where the application assumes that requests directed at the backend CGI handler are legitimate or sufficiently protected by upstream controls that are not actually being enforced for the specific setWiFiBasicCfg function. Consequently, the application trusts incoming POST requests without verifying the identity or privileges of the source.\nExploitation is achieved by crafting a malicious HTTP POST request targeted at /cgi-bin/cstecgi.cgi. An attacker needs to supply the required parameters expected by the setWiFiBasicCfg function, which typically include SSID, password, authentication modes, and other security settings. Since the application does not validate the session token or cookies of the request, it processes these parameters as if they were submitted by an authenticated administrative user.\nThe attack flow follows a direct request pattern: 1) The attacker identifies the target TOTOLINK T6 device via its network-exposed management port. 2) The attacker constructs a POST payload targeting /cgi-bin/cstecgi.cgi, explicitly calling the setWiFiBasicCfg action. 3) The attacker injects the desired wireless configuration parameters within the POST body. 4) The server-side binary, lacking an authentication gate for this specific function, processes the input and overwrites the active Wi-Fi configuration in the device's non-volatile memory or active configuration state.\nThe post-exploitation impact allows the attacker to fundamentally change the wireless security posture of the device. This includes modifying the SSID to perform evil-twin attacks, disabling encryption, changing pre-shared keys to gain unauthorized entry, or modifying channels to induce interference. Because this occurs at the configuration level, the changes can be persisted, allowing the attacker to maintain a foothold or facilitate further exploitation of devices connected to the compromised router."
}