Description

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T17:17:41.627Z",
  "pubdate": "2026-08-31T17:17:41.627Z",
  "executiveSummary": "This vulnerability involves an incorrect access control flaw within the TOTOLINK T6 firmware (version 4.1.5cu.748_B20211015), specifically residing in the setPairCfg function.\nThe vulnerability allows remote, unauthenticated attackers to manipulate the mesh pairing state of the device by submitting a maliciously crafted POST request to the /cgi-bin/cstecgi.cgi administrative interface.\nThe primary impact of this flaw is the unauthorized modification of system settings, which can lead to the subversion of mesh network topology, potential device hijacking, or the disruption of wireless connectivity.\nBecause the interface does not enforce proper authentication checks before executing the function, an attacker with network access to the device management interface can leverage this vulnerability to gain unauthorized control over mesh configurations.\nThis represents a significant security risk, as it bypasses standard authorization protocols, allowing for the manipulation of network infrastructure without valid administrative credentials.\nExploitation requires no prior authentication and can be executed over the network by sending a structured HTTP request to the vulnerable CGI endpoint.",
  "technicalDetails": "The vulnerability exists in the implementation of the /cgi-bin/cstecgi.cgi endpoint within the TOTOLINK T6 firmware version 4.1.5cu.748_B20211015.\nThe root cause is a failure to implement mandatory session validation or proper access control checks within the setPairCfg function, which is responsible for managing mesh pairing parameters.\nThe application relies on the CGI interface to process various administrative commands. When a POST request targeting the setPairCfg function is processed, the backend logic executes the configuration update without verifying the authorization state of the request initiator.\nAn attacker can exploit this by crafting a specific HTTP POST request directed at /cgi-bin/cstecgi.cgi, embedding the necessary parameters to invoke setPairCfg. By bypassing the authentication layer, the attacker can force the device to enter or modify mesh pairing states, effectively controlling the device's participation in a mesh network topology.\nThe attack flow proceeds as follows: First, the attacker identifies the reachable /cgi-bin/cstecgi.cgi endpoint on the target device. Second, the attacker formulates an HTTP POST request containing parameters interpreted by the setPairCfg function. Third, the firmware, failing to validate authentication tokens or session cookies, processes the input directly. Finally, the internal state of the mesh configuration is updated according to the attacker's payload.\nThis flaw exposes the device to unauthorized administrative modification. Because the mesh pairing state governs how devices establish trust and connect within a wider network, unauthorized modification could facilitate man-in-the-middle attacks or malicious device enrollment into an attacker-controlled mesh environment.\nThe lack of privilege verification on this function is a critical oversight in the command handler's security architecture, demonstrating a failure to apply the Principle of Least Privilege to sensitive system-level functions exposed via the web management interface."
}