Description

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T16:18:36.863Z",
  "pubdate": "2026-08-31T16:18:36.863Z",
  "executiveSummary": "The TOTOLINK T6 device running firmware version 4.1.5cu.748_B20211015 contains an improper access control vulnerability within its web management interface.\nSpecifically, the 'setOpModeCfg' function fails to enforce authentication checks, allowing unauthenticated remote attackers to modify the device's operational mode.\nThis vulnerability resides in the request handling logic of '/cgi-bin/cstecgi.cgi'.\nAn attacker can exploit this by sending a crafted POST request to the target URI without needing valid administrative credentials.\nThe primary impact involves unauthorized configuration changes, which could be leveraged to disrupt network connectivity, facilitate man-in-the-middle attacks, or transition the device into a state more conducive to further exploitation.\nThe vulnerability represents a significant risk to device integrity, as it exposes critical administrative functions to any entity capable of reaching the web management interface over the network.",
  "technicalDetails": "The vulnerability stems from flawed access control mechanisms within the TOTOLINK T6 firmware, specifically in how the 'setOpModeCfg' function processes incoming requests via the 'cstecgi.cgi' gateway.\nIn the affected version, 4.1.5cu.748_B20211015, the web application fails to validate the session state or verify the authorization level of the user before executing the configuration change logic invoked by the 'setOpModeCfg' command.\nThe 'cstecgi.cgi' script acts as the primary CGI handler for administrative actions on the device. When a POST request is directed to this URI, the internal logic parses the request body to identify the intended function and parameters. Because the 'setOpModeCfg' function lacks an explicit authentication barrier, it blindly processes the provided parameters to alter the operational configuration of the TOTOLINK T6.\nAn attack flow involves the following sequence: 1) The attacker crafts a malicious POST request targeting '/cgi-bin/cstecgi.cgi'. 2) The request body is populated with the necessary parameters to trigger 'setOpModeCfg' and set a specific, unauthorized operating mode. 3) The request is transmitted over HTTP/HTTPS to the device's management interface. 4) The device's CGI handler receives the request and, due to the missing access control checks, proceeds to execute the function directly. 5) The device updates its internal configuration state based on the attacker's payload, potentially disabling current services or altering the networking bridge configuration.\nBecause this interface is often exposed on the local network (LAN) and potentially the Wide Area Network (WAN) depending on user configuration, this vulnerability can be exploited by any network-adjacent or remote actor capable of reaching the device's management port.\nThe lack of authentication effectively bypasses the entire administrative security layer for this function. Successful exploitation allows an attacker to manipulate the fundamental operating mode of the router, which can be used to re-route traffic, disable firewalls, or create persistent misconfigurations that degrade the overall security posture of the network segment managed by the device."
}