Description

Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T16:18:36.223Z",
  "pubdate": "2026-08-31T16:18:36.223Z",
  "executiveSummary": "This vulnerability involves an incorrect access control flaw within the TOTOLINK T6 firmware, specifically affecting version 4.1.5cu.748_B20211015.\nThe vulnerability manifests as an improper authentication check in the setWiFiWpsStart function, which handles Wi-Fi Protected Setup (WPS) triggers.\nUnauthenticated remote attackers can leverage this defect to force the device into a pairing state without requiring valid administrative credentials.\nThe primary impact is a significant reduction in the security posture of the wireless network, as the device becomes susceptible to unauthorized WPS-based association.\nExploitation requires no prior authentication and can be performed by sending a specifically crafted POST request to the CGI interface.\nThis vulnerability poses a moderate-to-high risk as it allows unauthorized parties to manipulate router pairing configurations, potentially facilitating unauthorized network access or man-in-the-middle scenarios.",
  "technicalDetails": "The root cause of the vulnerability resides in the implementation of the setWiFiWpsStart function within the device's firmware binary, reachable through the web management interface via /cgi-bin/cstecgi.cgi.\nThe function fails to perform adequate session validation or authentication checks before executing the underlying logic that initializes the WPS pairing process.\nIn a standard deployment, the activation of WPS—a protocol intended for simplified device provisioning—should strictly require a pre-established administrative session to prevent malicious actors from triggering association procedures.\nThe attack flow begins when an attacker sends a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The CGI script parses the request and directs the call to the vulnerable setWiFiWpsStart function.\nBecause the function does not verify the requester's identity or current session state, the firmware proceeds to execute the WPS start command. This action effectively opens a 'window' of vulnerability where the router broadcasts its availability for WPS PIN or push-button registration.\nBy bypassing the required access control, the attacker creates a window of opportunity to interact with the WPS mechanism. In many scenarios, this allows an attacker to exploit known weaknesses in the WPS protocol, such as brute-forcing the 8-digit PIN, or simply to force the device to pair with an unauthorized station if the user does not intervene.\nThe vulnerability is exposed over the network, allowing any unauthenticated party with reachability to the web management interface to trigger the exploit.\nSince the CGI handling interface acts as a gateway to critical system functions, the lack of granular access control here represents a fundamental failure in the application's security architecture.\nThe post-exploitation impact includes the potential for unauthorized devices to join the wireless network, subverting standard WPA2/WPA3 authentication controls, and increasing the attack surface for further internal network compromise."
}