Description

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T16:18:36.430Z",
  "pubdate": "2026-08-31T16:18:36.430Z",
  "executiveSummary": "The TOTOLINK T6 router, specifically firmware version 4.1.5cu.748_B20211015, contains a critical improper access control vulnerability within its web management interface.\nThe vulnerability resides in the setManualDialCfg function, which is accessible via the /cgi-bin/cstecgi.cgi endpoint. This flaw permits unauthenticated remote attackers to modify the WAN (Wide Area Network) dial configuration states.\nSuccessful exploitation allows an adversary to manipulate critical network settings without requiring administrative credentials. This poses a significant security risk, as unauthorized modification of WAN settings can lead to network traffic redirection, denial of service, or the disruption of internet connectivity for connected clients.\nThe attack is executed by submitting a crafted POST request to the CGI interface. Because the endpoint fails to properly validate the session state or privilege levels of the requester, the device processes malicious configuration commands from any unauthenticated source reachable over the network.",
  "technicalDetails": "The root cause of this vulnerability is a failure to implement robust authentication checks within the setManualDialCfg function of the cstecgi.cgi component. In the TOTOLINK T6 firmware version 4.1.5cu.748_B20211015, this function is responsible for processing administrative requests related to WAN manual dialing configuration.\nThe vulnerability exists because the CGI handler does not verify whether an active, authenticated administrative session is associated with the incoming HTTP request. Consequently, the setManualDialCfg function assumes that any request directed to it is authorized, bypassing the standard access control enforcement mechanisms typically found in enterprise-grade networking equipment.\nExploitation occurs through a crafted HTTP POST request targeted at /cgi-bin/cstecgi.cgi. An attacker can construct a payload that includes specific parameters intended to modify the device's WAN dial state. When the web server receives this request, the CGI binary executes the setManualDialCfg logic, which then proceeds to update the internal configuration files or volatile memory states of the router based on the user-supplied input.\nThe attack flow is as follows: 1) The attacker identifies the target device's management interface, which is typically exposed on the local network or, in misconfigured environments, via the WAN interface. 2) The attacker crafts a POST payload that invokes the setManualDialCfg function with the desired configuration parameters. 3) The attacker transmits the HTTP request to the /cgi-bin/cstecgi.cgi endpoint. 4) The device processes the request without an authentication handshake, resulting in the immediate modification of the WAN configuration parameters.\nThe impact of successful exploitation is substantial, as it allows for unauthorized manipulation of the core network connectivity state. Beyond simple disruption, this could be leveraged as a precursor to more complex man-in-the-middle (MITM) attacks, where an attacker modifies DNS settings or gateway configurations to intercept traffic. Since the service does not perform privilege verification, the exploitation requires no elevated permissions or prior access to the device management dashboard, significantly lowering the barrier to entry for adversaries."
}