Executive brief
The TOTOLINK T6 router's web management interface contains a missing authentication check in the getCloudDownloadStatus function. An attacker on the network can send a crafted web request to query the device's cloud firmware download state without needing to log in, exposing operational information about pending firmware updates and potentially enabling further reconnaissance or targeted attacks against the device.
Technical details
The vulnerability is a missing authentication control (CWE-306/CWE-862) in the getCloudDownloadStatus function within the cstecgi.cgi web interface of TOTOLINK T6. Unauthenticated attackers can send a POST request to /cgi-bin/cstecgi.cgi with the appropriate function parameter to retrieve cloud firmware download status information. The attack requires network access to the device's HTTP management interface but no authentication credentials or user interaction. The impact is limited to information disclosure; however, this information could be used to reconnaissance the device state for further attacks. A patch status is not mentioned in available sources.
Affected products
- TOTOLINK T6 4.1.5cu.748_B20211015
Timeline
- 2026-08-31: disclosed