Description

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T16:18:36.647Z",
  "pubdate": "2026-08-31T16:18:36.647Z",
  "executiveSummary": "This vulnerability is an Incorrect Access Control flaw within the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. The issue resides in the delMacFilterRules function, which fails to enforce session-based authentication or administrative authorization for specific POST requests directed at the /cgi-bin/cstecgi.cgi endpoint.\nThe vulnerability allows an unauthenticated, remote attacker to manipulate network security policies by deleting established MAC address filter rules. By bypassing authentication mechanisms, an attacker can effectively disable security restrictions intended to limit network access based on hardware identifiers. This exposes the device to unauthorized device connection, potentially facilitating man-in-the-middle attacks, unauthorized network traffic exfiltration, or secondary exploitation of other devices on the local area network. The lack of validation for the requester's identity poses a significant risk to the integrity of the network's perimeter defense, necessitating immediate attention to device access control implementation.",
  "technicalDetails": "The root cause of this vulnerability is an improper access control check within the implementation of the delMacFilterRules function in the TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The device's management interface utilizes the /cgi-bin/cstecgi.cgi script to handle various administrative tasks and configuration changes through POST requests.\nDuring the processing of these requests, the delMacFilterRules function fails to verify whether the incoming request originates from a session with valid administrative privileges. Consequently, the CGI handler accepts requests without requiring a valid session cookie or token, rendering the administrative function exposed to any attacker who can reach the device's web interface over the network.\nThe exploitation flow begins when an attacker crafts a malicious HTTP POST request targeting the /cgi-bin/cstecgi.cgi endpoint. The payload is constructed to invoke the delMacFilterRules function with parameters that identify specific MAC filter entries to be purged from the internal rule database. Because the underlying CGI handler lacks an authentication gatekeeper for this specific function, the backend routine executes the deletion command with the authority of the web server process.\nUpon receipt of the crafted request, the system processes the command and updates the system's firewall configuration or Access Control List (ACL) to remove the targeted MAC filter rules. This action immediately weakens the device's perimeter security, as the specified devices that were previously blocked are now permitted to associate with the network, provided their MAC addresses were the subject of the deleted rules.\nThe attack is characterized by its simplicity and lack of required prerequisites, such as prior knowledge of administrative credentials. As the affected component handles critical security policy enforcement, the failure to protect this function exposes the network to unauthorized access. The impact is persistent until the administrator manually reconfigures the MAC filtering rules or the device is restored to a previous state, assuming the changes are written to non-volatile configuration memory. This vulnerability highlights a critical failure in the Principle of Least Privilege, as a management interface function is exposed to unauthenticated users via the device's main CGI management conduit."
}