Executive brief
TOTOLINK T6 is a wireless router commonly used in home and small office networks. The router's administrative interface contains a flaw that allows unauthenticated attackers to upload and install arbitrary CGI modules, effectively taking complete control of the device. This could enable an attacker to intercept network traffic, steal credentials, or use the router as a pivot point for attacking other devices on the network.
Technical details
The vulnerability is an authentication bypass in the UploadCustomModule function of the cstecgi.cgi CGI script. The function fails to validate whether a user is authenticated before processing custom module installation requests, allowing unauthenticated attackers to send a crafted POST request to /cgi-bin/cstecgi.cgi and upload malicious CGI modules. This is a missing access control check, classified as CWE-306 (missing authentication for critical function). The attack vector is network-based and requires no user interaction or prior authentication. Once exploited, an attacker gains arbitrary code execution on the router with administrator-level privileges.
Affected products
- TOTOLINK T6 4.1.5cu.748_B20211015
Timeline
- 2026-08-31: disclosed