Description

Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T16:18:36.760Z",
  "pubdate": "2026-08-31T16:18:36.760Z",
  "executiveSummary": "A critical access control vulnerability exists in the TOTOLINK T6 router, specifically within the delPortForwardRules function. This flaw allows unauthenticated remote attackers to delete existing port-forwarding configurations without requiring valid session credentials or administrative privileges.\nThe vulnerability resides in the /cgi-bin/cstecgi.cgi script, which fails to enforce authentication checks before processing modification requests. By submitting a crafted POST request, an adversary can manipulate the device's firewall rules, potentially disrupting network connectivity for specific services or weakening the device's security posture.\nThis vulnerability is classified as an improper access control issue. The impact is significant, as it enables unauthorized modification of device configuration settings, which can be leveraged to cause denial-of-service conditions or facilitate further exploitation of the network by removing legitimate access rules. There are no authentication or privilege requirements, making the device highly susceptible to exploitation over a network if the management interface is accessible.",
  "technicalDetails": "The vulnerability originates from an insecure implementation of the delPortForwardRules function located within the firmware of the TOTOLINK T6, version 4.1.5cu.748_B20211015. The core issue is an improper authentication bypass vulnerability that occurs during the processing of incoming requests to the /cgi-bin/cstecgi.cgi Common Gateway Interface (CGI) handler.\nIn a secure implementation, the CGI handler should validate the session token or authentication cookie of any incoming request before invoking administrative functions. However, the delPortForwardRules function is exposed in a manner that bypasses these security checks. An attacker can transmit a specially crafted POST request directly to the cstecgi.cgi endpoint without providing any authorization headers or session data.\nThe attack flow follows a direct exploitation pattern. First, the attacker identifies the target device's IP address and ensures network reachability to the CGI interface. Second, the attacker constructs a POST request targeting the delPortForwardRules action, typically passing the relevant parameters required to identify the specific port-forwarding rule to be deleted. Because the application logic fails to verify the requestor's identity, the system proceeds to parse the request, executes the internal function, and removes the targeted rule from the device's internal configuration database.\nThis behavior is persistent; once the rule is deleted, it is removed from the device configuration, potentially causing immediate loss of connectivity for the associated network services. The lack of input validation or authorization checks at the function level allows an adversary to iterate through existing rules—if the rule identifiers are predictable or discoverable—leading to the mass deletion of port-forwarding configurations.\nThe vulnerable component is the web management interface of the TOTOLINK T6. The exploitation occurs purely at the application layer of the network protocol stack. Because the device processes these requests without authentication, it exposes the administrative functionality to any remote user capable of reaching the management interface, effectively bypassing the intended security boundaries of the device's administrative access control list."
}