Description

Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T17:17:41.523Z",
  "pubdate": "2026-08-31T17:17:41.523Z",
  "executiveSummary": "The TOTOLINK T6 router (version 4.1.5cu.748_B20211015) contains a critical access control vulnerability located within the cstecgi.cgi interface. The vulnerability resides specifically in the delIpPortFilterRules function, which fails to implement necessary authentication checks for administrative actions.\nAn unauthenticated, remote attacker can leverage this flaw to manipulate the device's firewall configuration by sending a specifically crafted POST request. By successfully invoking this function, an attacker can programmatically remove active firewall filter rules, thereby degrading the security posture of the network perimeter.\nThis vulnerability poses a significant risk to the integrity of the device's security policies. Because the interface does not validate the session or authorization level of the requester, the device effectively permits unauthorized modifications to its internal filtering logic. This exposure allows for the bypass of network access restrictions, potentially enabling unauthorized traffic flows that were previously blocked by configured rules. Exploitation requires no prior authentication and can be executed over the network, making it a high-priority security concern for deployments of this specific firmware version.",
  "technicalDetails": "The vulnerability is rooted in an improper authorization check within the web management backend of the TOTOLINK T6, specifically targeting the cstecgi.cgi Common Gateway Interface (CGI) handler. Analysis of the firmware indicates that the delIpPortFilterRules function, responsible for modifying or deleting IP and port-based filtering rules in the device's firewall (iptables/nftables), lacks mandatory authentication validation routines. Typically, such administrative functions should be gated by a session-based access control mechanism that validates the user's privilege level before executing the backend command.\nThe exploitation mechanism involves the transmission of a crafted HTTP POST request directed at the /cgi-bin/cstecgi.cgi endpoint. The request structure utilizes the underlying command-parsing logic of the CGI, where parameters are parsed and passed to the internal delIpPortFilterRules function. Since the application fails to verify the existence of a valid administrative session cookie or token, the function proceeds to execute the logic to modify the firewall chain without verification.\nThe attack flow follows a predictable sequence: First, the attacker identifies the target endpoint (/cgi-bin/cstecgi.cgi). Second, the attacker constructs a POST payload targeting the delIpPortFilterRules function, providing necessary arguments or indices corresponding to the specific firewall rules to be removed. Third, the request is dispatched to the target device. Upon receipt, the web server process, running with elevated system privileges (typically root), invokes the vulnerable function. The function executes the removal logic, which interacts directly with the system's underlying firewall configuration. Finally, the firewall rules are purged or modified according to the attacker's inputs.\nThe impact of this exploitation is a complete compromise of the router’s configured network traffic filtering. By removing filter rules, an attacker can effectively disable blacklists or whitelist restrictions, potentially opening doors for further lateral movement within the local network or exposing internal services to the WAN that were intended to be unreachable. Furthermore, the lack of authentication ensures that this action leaves minimal forensic evidence beyond standard web server logs, as the request appears as a legitimate management action. The flaw is confined to firmware version 4.1.5cu.748_B20211015, highlighting a failure in secure development practices regarding input validation and session management for administrative CGI endpoints."
}