Executive brief
TOTOLINK T6 is a residential wireless router that manages network connectivity and configuration. An unauthenticated attacker can modify the router's language settings by sending a specially crafted request to the web interface, bypassing authentication controls. While language changes may seem minor, this demonstrates a fundamental authentication weakness that could be exploited to access other sensitive configuration functions on the device.
Technical details
The vulnerability is an authentication bypass in the setLanguageCfg function within the CGI handler (/cgi-bin/cstecgi.cgi) of TOTOLINK T6 firmware. The function lacks proper access control checks and can be invoked by unauthenticated attackers via a crafted HTTP POST request. An attacker with network access to the router (either local network or WAN, depending on firewall configuration) can modify the device's language settings without authentication. This indicates a broader pattern of missing authentication checks in the device's CGI interface, as evidenced by multiple related CVEs affecting other functions in the same binary. The vulnerability requires no user interaction and can be triggered remotely.
Affected products
- TOTOLINK T6 4.1.5cu.748_B20211015
Timeline
- 2026-08-31: disclosed