Executive brief
TOTOLINK T6 is a router device used in home and small business networks. An unauthenticated attacker can reconfigure the router's uplink (WAN) settings by sending a crafted web request, potentially disrupting internet connectivity, redirecting traffic, or enabling further compromise of the network.
Technical details
The setWanIeCfg function in the cstecgi.cgi web interface lacks proper authentication checks, allowing unauthenticated attackers to modify WAN configuration settings. The vulnerability is triggered via a POST request to /cgi-bin/cstecgi.cgi without credentials. Since the web interface is typically network-accessible on the router, any remote attacker can craft and send the malicious request. An attacker can thus reconfigure upstream network parameters, leading to denial of service, traffic interception, or network redirection. The fix requires adding authentication validation to the setWanIeCfg function handler.
Affected products
- TOTOLINK T6 4.1.5cu.748_B20211015
Timeline
- 2026-08-31: disclosed