Description

Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T16:18:36.970Z",
  "pubdate": "2026-08-31T16:18:36.970Z",
  "executiveSummary": "This vulnerability involves an incorrect access control flaw within the TOTOLINK T6 router firmware, specifically identified in version 4.1.5cu.748_B20211015.\nThe issue resides in the delStaticDhcpRules function, which is reachable via the /cgi-bin/cstecgi.cgi endpoint.\nThis vulnerability allows an unauthenticated, remote attacker to trigger the deletion of static DHCP reservations without requiring valid session credentials or administrative privileges.\nThe primary risk is the loss of network configuration integrity, which can lead to service disruption or facilitate man-in-the-middle (MITM) attacks by causing IP address conflicts or forcing unintended device re-assignment.\nSuccessful exploitation requires the attacker to be reachable via the network interface that serves the CGI endpoint and the ability to craft and transmit a specific POST request.\nNo authentication or session token is required to interact with the vulnerable function, lowering the barrier for exploitation.",
  "technicalDetails": "The vulnerability originates from an improper implementation of access control checks within the web administrative interface of the TOTOLINK T6 device. Specifically, the function delStaticDhcpRules, responsible for managing static DHCP mapping, fails to verify the authentication status of the incoming HTTP request before processing the command.\nThe affected component is the cgi-bin handler, located at /cgi-bin/cstecgi.cgi, which acts as the gateway for various administrative tasks. By design, requests sent to this endpoint should undergo a session validation check to ensure the requester is an authorized administrator. However, the logic handling the delStaticDhcpRules call bypasses this security gate, permitting unauthenticated execution.\nTo exploit this, an attacker transmits a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The request parameters must be structured to invoke the delStaticDhcpRules function with the necessary arguments to identify the targeted DHCP rule. Because the backend code assumes trust in any request reaching this function, it proceeds to execute the logic that modifies the system configuration without further validation.\nThe attack flow follows these steps: 1) The attacker constructs a POST request formatted according to the internal requirements of the cstecgi.cgi interface. 2) The attacker transmits this request over the network to the device's web management interface. 3) The web server dispatches the request to the CGI handler. 4) The handler invokes the delStaticDhcpRules function. 5) The function logic executes, deleting the specified static DHCP reservation from the system's configuration database. 6) The device immediately applies the change, effectively removing the fixed IP assignment for the victim device.\nThe post-exploitation impact includes the loss of static IP stability for network clients, which can be leveraged to cause connectivity issues or to facilitate subsequent attacks. By removing a static mapping, an attacker can trigger a dynamic IP re-assignment, which may allow the attacker to spoof or intercept traffic meant for the original owner of that static IP. Furthermore, the lack of integrity in the DHCP configuration allows an attacker to disrupt organizational network management protocols and potentially induce Denial of Service (DoS) for critical network infrastructure components that rely on fixed addressing."
}