Description

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T20:17:04.990Z",
  "pubdate": "2026-08-31T20:17:04.990Z",
  "executiveSummary": "This vulnerability involves an improper access control flaw within the TOTOLINK T6 firmware, specifically version 4.1.5cu.748_B20211015.\nThe security defect resides in the clearTracerouteLog function, which fails to adequately validate the session state or authentication credentials of incoming requests.\nAn unauthenticated, remote attacker can leverage this oversight to gain unauthorized access to administrative functionality, specifically the ability to purge traceroute diagnostic logs.\nThe primary impact of this vulnerability is a loss of system integrity and auditability, as attackers can erase evidence of network reconnaissance or malicious activity conducted via the device.\nExploitation requires no special privileges or prior authentication, necessitating only network access to the target device's CGI interface.\nThis flaw presents a significant risk to incident response and forensic capabilities, allowing attackers to cover their tracks effectively after performing unauthorized network diagnostics.",
  "technicalDetails": "The vulnerability originates from a deficiency in the access control logic implemented within the /cgi-bin/cstecgi.cgi endpoint of the TOTOLINK T6 firmware (v4.1.5cu.748_B20211015).\nSpecifically, the internal handler for the clearTracerouteLog function lacks a mandatory authentication check, enabling the invocation of administrative log-clearing operations by unauthorized users.\nIn a standard deployment, the /cgi-bin/cstecgi.cgi script acts as a command dispatcher for administrative actions. The application architecture relies on internal function wrappers to handle requests sent via the POST protocol.\nThe attack flow proceeds as follows: An attacker identifies the accessible CGI interface reachable over the network. By crafting a specific HTTP POST request directed at /cgi-bin/cstecgi.cgi, the attacker can encapsulate parameters that trigger the execution of the clearTracerouteLog function.\nBecause the function is improperly exposed without session validation or authorization checks, the web server executes the code responsible for flushing the internal traceroute log buffers directly.\nThis results in the immediate deletion of all stored traceroute diagnostic data residing in the system's memory or persistent storage, depending on the specific implementation of the logging subsystem.\nThe vulnerability is critical from a forensics perspective because it allows an attacker to manipulate the device's state to impede audit trail analysis. If an attacker utilizes the T6 for malicious network scanning, they can trigger this vulnerability post-action to remove logs that would otherwise indicate the target of their reconnaissance.\nThe exploit does not require interaction with the administrative web interface's GUI components, as it bypasses the frontend entirely by interacting directly with the backend CGI binary. The absence of rate-limiting or authenticated tokens in this specific function path permits repeated attempts, ensuring success once the request structure is identified.\nThe vulnerability exists purely due to an insecure design pattern in the firmware's authorization layer, where specific diagnostic-management functions are incorrectly treated as public-facing or implicitly trusted."
}