Description

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T20:17:04.460Z",
  "pubdate": "2026-08-31T20:17:04.460Z",
  "executiveSummary": "The TOTOLINK T6 router (version 4.1.5cu.748_B20211015) contains an incorrect access control vulnerability within its web management interface.\nThe flaw resides in the 'delWiFiScheduleCfg' function, which fails to adequately validate the session state of incoming requests.\nThis vulnerability allows unauthenticated, remote attackers to send a specially crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint to delete existing Wi-Fi schedule configurations.\nThe primary risk involves the unauthorized modification of device settings, leading to potential denial of service regarding wireless access or disruption of network security policies defined by the Wi-Fi schedule.\nExploitation does not require valid credentials or administrative privileges, significantly lowering the barrier for entry for malicious actors on the local network.\nThe integrity of the device configuration is compromised, as attackers can programmatically alter the behavior of the router's wireless radio states without authentication.",
  "technicalDetails": "The vulnerability is classified as an improper access control issue within the web-based administrative backend of the TOTOLINK T6, specifically affecting the 'delWiFiScheduleCfg' function.\nThe device manages internal configuration operations through a centralized Common Gateway Interface (CGI) script located at '/cgi-bin/cstecgi.cgi'. This script serves as the routing mechanism for various management functions, including Wi-Fi scheduling operations.\nThe root cause of this vulnerability is the lack of mandatory session validation or authentication checks prior to the execution of the logic within 'delWiFiScheduleCfg'. When a POST request is directed to the CGI handler with parameters intended to invoke the deletion of a Wi-Fi schedule entry, the underlying application logic fails to verify if the requester has successfully authenticated via the login portal.\nAn attacker can exploit this by crafting a POST request containing the necessary parameters to trigger the 'delWiFiScheduleCfg' function. Because the function processes the request as if it originated from an authorized administrative session, the backend performs the operation with the privileges of the web management service. The attacker does not need to bypass a login challenge, as the internal routing logic treats the request as a legitimate command.\nThe attack flow begins with the attacker identifying the target endpoint at '/cgi-bin/cstecgi.cgi'. By observing the structure of valid configuration requests, the attacker constructs a malicious payload that specifies the identifier of the Wi-Fi schedule entry to be removed. Upon transmitting this payload via an HTTP POST method to the target, the web server processes the request through the CGI handler. The handler then dispatches the task to the vulnerable 'delWiFiScheduleCfg' function, which executes the deletion process directly against the NVRAM or configuration storage backend.\nThe result is the immediate and unauthorized removal of scheduled Wi-Fi availability settings. This impacts the operational security and configuration integrity of the TOTOLINK T6, allowing remote attackers to manipulate device state without knowledge of the administrative credentials. Since the service is exposed to the local network (and potentially the WAN if remote management is enabled), this vulnerability provides a vector for unauthorized persistent configuration changes."
}