Description

Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T16:18:36.117Z",
  "pubdate": "2026-08-31T16:18:36.117Z",
  "executiveSummary": "This vulnerability is an improper access control flaw identified within the TOTOLINK T6 firmware version 4.1.5cu.748_B20211015.\nThe issue permits unauthenticated remote attackers to modify parental control configurations without requiring valid administrative session tokens or credentials.\nThe vulnerability resides in the handling of the setParentalRules function invoked via the cgi-bin/cstecgi.cgi interface.\nBy bypassing standard authentication checks, an attacker can exert control over device filtering rules, effectively overriding network restrictions.\nThe risk implication is significant as it allows for unauthorized manipulation of security policies, potentially leading to unauthorized network access or the circumvention of established parental safeguards.\nSuccessful exploitation requires no prior authentication, exposing the device to external manipulation if the web interface is accessible via the network.",
  "technicalDetails": "The vulnerability originates from a failure to enforce authentication constraints within the setParentalRules function in the TOTOLINK T6 firmware (4.1.5cu.748_B20211015). The device processes requests via the /cgi-bin/cstecgi.cgi endpoint, which acts as a common gateway for various administrative tasks.\nIn this specific implementation, the setParentalRules function fails to validate the session state or the authentication status of the incoming request. When a request is dispatched to the cgi-bin/cstecgi.cgi endpoint with the relevant parameters targeting setParentalRules, the firmware executes the configuration change logic without confirming that the requester possesses the necessary administrative privileges.\nThe attack flow involves an adversary crafting a specialized POST request directed at the aforementioned CGI script. Because the target function lacks rigorous access control checks, the server-side logic processes the POST body—which contains the desired modifications to parental control rules—as a legitimate administrative command. This allows the attacker to alter, delete, or create new filtering rules that define the network behavior for specific clients or devices connected to the T6 router.\nThe root cause is an insecure functional design pattern where security-sensitive operations are exposed to the network interface without an intermediate verification layer to ensure that the request originated from an authenticated user. This effectively turns an administrative interface into an unauthenticated control point.\nPost-exploitation, the attacker can manipulate the parental control settings to disable restrictions on specific network hosts, potentially granting unrestricted internet access to restricted devices, or conversely, disrupting connectivity for specific users by applying overly restrictive filtering profiles. Because the modification happens at the firmware configuration level, the changes persist until they are manually reverted by a legitimate administrator, significantly altering the security posture of the router."
}