Description

Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T20:17:04.353Z",
  "pubdate": "2026-08-31T20:17:04.353Z",
  "executiveSummary": "This vulnerability is an incorrect access control flaw identified within the TOTOLINK T6 firmware version 4.1.5cu.748_B20211015.\nThe vulnerability resides in the delVlanCfg function, which fails to enforce authentication or authorization checks when processing requests.\nAn unauthenticated, remote attacker can exploit this weakness by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to invoke the vulnerable function.\nThe primary impact of this flaw is the unauthorized deletion of VLAN entries, which can lead to network segmentation bypasses, denial of service regarding specific network traffic, or unauthorized connectivity changes within the infrastructure.\nThe vulnerability represents a significant security risk, as it permits arbitrary configuration modification without requiring any valid session credentials.\nExploitation requires network access to the device's management interface but does not mandate prior authentication or administrative privileges.",
  "technicalDetails": "The vulnerability is localized within the firmware implementation of the delVlanCfg function, which is responsible for managing VLAN table entries on the TOTOLINK T6 router.\nThe root cause is a failure in the application's access control logic within the /cgi-bin/cstecgi.cgi CGI handler. The system fails to validate the session state or the authenticity of the requester before executing administrative actions passed through POST parameters.\nThe attack flow begins when an attacker sends a crafted POST request to the /cgi-bin/cstecgi.cgi script. This CGI script serves as a gateway to internal system functions. Because the delVlanCfg function does not perform secondary authentication checks or verify the request's origin against a valid session token, the underlying logic proceeds to execute the requested command.\nBy manipulating the parameters sent in the POST body, the attacker can force the firmware to execute the deletion logic targeting specific VLAN identifiers or indices. Since the function lacks input sanitization and access control, it performs the requested operation directly on the internal configuration files or memory structures managing VLAN settings.\nThe affected component is the internal CGI interface responsible for administrative configuration management in version 4.1.5cu.748_B20211015 of the TOTOLINK T6 firmware.\nSuccessful exploitation allows for persistent or transient removal of VLAN configurations. This can be used to disrupt network traffic, isolate or expose devices on a network, or perform further reconnaissance by forcing traffic onto default or untagged interfaces.\nThe vulnerability is exposed via the network, meaning any entity with reachability to the web management interface of the device can trigger the exploit. No user interaction or elevated privileges are required, making it a critical failure in the device's security boundary."
}