Executive brief
The TOTOLINK T6 router's web management interface lacks proper authentication checks in its guest WiFi configuration function. An unauthenticated attacker can remotely modify guest wireless network settings by sending a crafted web request, allowing them to enable, disable, or weaken the security of guest network access without needing valid credentials.
Technical details
This vulnerability is an improper access control flaw in the setWiFiGuestCfg function exposed via the /cgi-bin/cstecgi.cgi endpoint. The function fails to validate user authentication before processing POST requests to modify guest WiFi configuration. An unauthenticated network attacker can send a malicious POST request to alter guest wireless settings without requiring valid login credentials or CSRF tokens. This allows an attacker to establish new guest networks or weaken their security parameters (e.g., disable encryption, change PSK). The vulnerable code path is network-accessible from the WAN interface by default on affected firmware versions.
Affected products
- TOTOLINK T6 4.1.5cu.748_B20211015
Timeline
- 2026-08-31: disclosed