Description

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T16:18:37.077Z",
  "pubdate": "2026-08-31T16:18:37.077Z",
  "executiveSummary": "The TOTOLINK T6 router, specifically version 4.1.5cu.748_B20211015, contains a critical incorrect access control vulnerability within its web management interface.\nThe vulnerability resides in the delUrlFilterRules function, which handles the deletion of URL filtering rules.\nAn unauthenticated, remote attacker can exploit this flaw by sending a specifically crafted POST request to the cgi-bin/cstecgi.cgi endpoint.\nSuccessful exploitation allows unauthorized modification of the device's security policy, specifically the ability to delete existing URL filter rules without valid administrative credentials.\nThis represents a significant security risk, as an attacker can bypass content filtering mechanisms, potentially enabling access to restricted or malicious web resources.\nThe vulnerability is classified as an authorization bypass, as the application fails to perform mandatory authentication checks before executing administrative operations.",
  "technicalDetails": "The vulnerability is located within the cstecgi.cgi binary, which serves as the primary gateway for administrative functions on the TOTOLINK T6 router. The specific function responsible for this flaw is delUrlFilterRules.\nThe root cause of the vulnerability is an insecure implementation of access control mechanisms. The function fails to verify the session state or the authentication status of the requester before processing requests.\nWhen a user or attacker interacts with the URL filtering management interface, the application receives a POST request directed at /cgi-bin/cstecgi.cgi. This binary acts as a dispatcher for various backend management functions.\nBy crafting a POST request containing parameters targeted at the delUrlFilterRules function, an external entity can bypass the authentication gate. The application incorrectly assumes that requests to this specific function are inherently legitimate or authorized.\nExploitation involves sending a structured HTTP POST request to the device's web server. The request must include the appropriate parameters expected by the delUrlFilterRules function to identify which rule index should be removed. Because there is no token validation or session cookie enforcement, the web server executes the command with administrative privileges despite the lack of authentication.\nThe attack flow is as follows: 1) The attacker identifies the endpoint /cgi-bin/cstecgi.cgi; 2) The attacker constructs a POST payload specifying the removal of a URL filter rule; 3) The payload is transmitted to the target device over the network; 4) The cstecgi.cgi handler invokes delUrlFilterRules without validating the requester's identity; 5) The device processes the deletion, successfully modifying the firewall or filter ruleset according to the attacker's request.\nThis vulnerability is particularly concerning as it is exposed over the network, potentially allowing remote exploitation. The absence of authentication requirements means that any party with network access to the device's web interface can manipulate its configuration, leading to a loss of integrity in the device's security policies.\nImpact includes the degradation of administrative controls, enabling the circumvention of parental controls or corporate compliance rulesets enforced by the router's URL filtering capabilities."
}