Description

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T20:17:05.320Z",
  "pubdate": "2026-08-31T20:17:05.320Z",
  "executiveSummary": "The TOTOLINK T6 router, specifically firmware version 4.1.5cu.748_B20211015, contains an incorrect access control vulnerability within the device's CGI interface.\nThis flaw resides in the 'killProcess' function, which fails to adequately validate the authorization status of incoming requests.\nAn unauthenticated, remote attacker can leverage this vulnerability to arbitrarily terminate critical system services by submitting a specially crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint.\nThe exploitation of this vulnerability results in a denial-of-service (DoS) condition, as the targeted services cease to function upon execution of the payload.\nThe vulnerability is critical due to the ease of exploitation, as it requires no prior authentication or administrative privileges to interact with the underlying system management functions.\nSuccessful exploitation disrupts device stability and network management capabilities, posing a significant risk to the availability and operational integrity of the affected TOTOLINK T6 hardware.",
  "technicalDetails": "The root cause of this vulnerability is an improper access control implementation within the internal logic of the '/cgi-bin/cstecgi.cgi' binary, specifically concerning the 'killProcess' function handler.\nIn secure embedded device architectures, administrative functions exposed via CGI interfaces must enforce strict session validation or authentication checks before executing privileged system commands.\nIn the affected version of the TOTOLINK T6 (4.1.5cu.748_B20211015), the 'killProcess' function does not verify if the request originator possesses a valid administrative session token or legitimate user credentials.\nThe attack flow begins when an unauthenticated attacker transmits a crafted HTTP POST request directed at '/cgi-bin/cstecgi.cgi'.\nThe request body is designed to invoke the 'killProcess' routine by providing the necessary parameters required by the function to identify and terminate a target system process.\nBecause the function lacks authentication gating, the web server's execution environment treats the request as a valid administrative command.\nOnce the CGI handler processes the POST parameters, it calls the internal system 'kill' command or equivalent API with the parameters supplied by the attacker.\nThis allows the attacker to specify the Process ID (PID) or process name to be terminated, effectively enabling them to kill network services, management daemons, or other background tasks essential for the router's operation.\nThe post-exploitation impact is a forced Denial of Service, which may range from the cessation of routing services to the crashing of the web administrative interface itself, depending on which critical process is targeted.\nThis vulnerability is reachable over the network, and provided the device's administrative web interface is exposed to the local network or the internet, it serves as an easily accessible attack vector for any remote actor capable of sending HTTP traffic to the device."
}