Description

Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T18:17:18.430Z",
  "pubdate": "2026-08-31T18:17:18.430Z",
  "executiveSummary": "The TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 contains an improper access control vulnerability within the SystemSettings function.\nThis security flaw allows unauthenticated remote attackers to bypass authorization mechanisms to access sensitive administrative endpoints.\nThe vulnerability resides in the /cgi-bin/cstecgi.cgi endpoint, which fails to enforce strict authentication checks for specific configuration import and export operations.\nBy submitting a specially crafted POST request, an attacker can retrieve internal system path information or administrative interface parameters.\nThe risk implication is significant as it exposes internal application logic and configuration structures, facilitating further reconnaissance or potential unauthorized device modifications.\nExploitation requires network access to the target device, but does not necessitate prior authentication, allowing attackers to leverage the device's management interface remotely.",
  "technicalDetails": "The vulnerability is localized within the SystemSettings function of the TOTOLINK T6 router firmware, specifically triggered via the /cgi-bin/cstecgi.cgi Common Gateway Interface script.\nThe root cause is a failure in the application's access control logic, which does not properly validate the session state or authorization tokens before processing requests related to administrative configuration operations.\nWhen a user or attacker interacts with the /cgi-bin/cstecgi.cgi endpoint, the application is expected to verify that the request originates from a session with administrative privileges; however, the SystemSettings function fails to enforce these checks.\nThe attack flow begins with the attacker sending a crafted POST request directed at the /cgi-bin/cstecgi.cgi script. This request is designed to target the backend functions responsible for managing administrative import and export operations.\nBecause the function lacks authentication requirements, the server processes the payload regardless of the requester's identity. Upon execution, the function inadvertently discloses sensitive metadata and endpoint definitions related to administrative file handling.\nThis disclosure facilitates the mapping of internal backend routines. By analyzing the returned information, an attacker can identify the specific parameters and required structures for interacting with the device's configuration management subsystem.\nThe exposure of these endpoints is a critical security concern as they are intended for use only by authenticated administrators. The lack of network-layer or application-layer authentication allows for unauthorized information gathering without the need to intercept legitimate credentials or bypass traditional login forms.\nThe post-exploitation impact includes increased exposure to subsequent attacks. By identifying the exact structure of administrative import/export operations, an attacker can potentially attempt further unauthorized actions, such as uploading malicious configuration files or extracting existing configuration data that may contain sensitive system information."
}