Description

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T17:17:41.730Z",
  "pubdate": "2026-08-31T17:17:41.730Z",
  "executiveSummary": "The TOTOLINK T6 router, version 4.1.5cu.748_B20211015, contains a critical security vulnerability stemming from improper access control within its configuration management interface.\nThis vulnerability is classified as an authorization bypass, allowing unauthenticated remote attackers to modify critical device settings.\nSpecifically, the flaw resides in the setWiFiRepeaterCfg function, which fails to enforce authentication checks when processing POST requests sent to the /cgi-bin/cstecgi.cgi endpoint.\nBy successfully exploiting this, an attacker can arbitrarily reconfigure the device's upstream Wi-Fi settings, effectively performing a man-in-the-middle (MITM) or redirection attack by forcing the router to associate with an attacker-controlled access point.\nThe risk implication is severe, as it facilitates traffic interception, credential harvesting, and the potential injection of malicious payloads into the local network traffic of connected clients.\nThis exploitation does not require prior knowledge of administrator credentials or physical access to the device, making it highly exploitable from the network perimeter if the administration interface is exposed to the WAN or accessible to unauthorized local network entities.",
  "technicalDetails": "The vulnerability originates from a failure in the application's request handling logic within the /cgi-bin/cstecgi.cgi script. The web management interface utilizes this CGI binary to process various configuration tasks; however, the setWiFiRepeaterCfg function lacks the mandatory session validation logic required to confirm the identity of the requester before applying configuration changes.\nIn a standard implementation, calls to configuration-altering functions should trigger a verification check against the active session token stored in the browser cookie or the system session table. In the affected TOTOLINK T6 firmware version, the function executes the requested configuration updates regardless of the authentication header or cookie presence.\nThe attack flow begins when an attacker identifies the target device's IP address and crafts a specific HTTP POST request directed at /cgi-bin/cstecgi.cgi. The request body must be structured to match the expected parameters for the setWiFiRepeaterCfg function, which include the target SSID, security mode, and pre-shared key for the upstream network connection.\nBecause the function fails to validate session privileges, the underlying system processes these parameters as legitimate administrative commands. The device then disconnects from its current legitimate upstream network and attempts to bridge to the SSID provided in the malicious POST request. If the attacker-controlled access point is broadcasting, the TOTOLINK T6 will successfully complete the handshake.\nPost-exploitation, the attacker assumes a strategic position in the network topology. By masquerading as the upstream gateway, the attacker can intercept, log, or modify unencrypted traffic originating from the local network. Furthermore, this facilitates the redirection of users to malicious websites or the delivery of further exploit payloads to devices within the TOTOLINK T6's internal network. Since this process occurs at the device level, the modification persists until a manual reset or a secondary unauthorized configuration change is performed by the attacker, effectively giving them persistent control over the device's internet connectivity and traffic flow."
}