Executive brief
TOTOLINK T6 is a Wi-Fi router used in homes and small businesses to provide wireless connectivity and manage network devices. The device's configuration interface lacks proper access controls on a function that manages DHCP reservations (static IP assignments for network devices). An unauthenticated attacker on the network can send a specially crafted request to delete these reservations, disrupting network device connectivity and causing operational downtime.
Technical details
The delStaticDhcpRules function in the cstecgi.cgi web interface lacks authentication checks, allowing unauthenticated POST requests to modify device configuration. An attacker with network access to the router can send a crafted HTTP request to /cgi-bin/cstecgi.cgi to invoke this function and delete static DHCP reservations without authentication. This is a classic missing authentication vulnerability affecting a sensitive administrative function. No authentication or CSRF tokens are validated before processing the deletion request. Patches or workarounds, if available, would involve implementing proper authentication checks on all sensitive cstecgi.cgi functions.
Affected products
- TOTOLINK T6 4.1.5cu.748_B20211015
Timeline
- 2026-08-31: disclosed