Executive brief
TOTOLINK N600R is a consumer-grade wireless router used to provide network connectivity and security management. The device generates administrative session tokens using a predictable method (MD5 hash of the current Unix timestamp), allowing an unauthenticated attacker to brute-force valid authentication tokens within a short time window and gain complete control of the router. An attacker with this access can modify network settings, change Wi-Fi credentials, install malware, or disconnect users from the network entirely.
Technical details
The vulnerability is classified as CWE-330 (Use of Insufficiently Random Values). The loginAuth handler in /web_cste/cgi-bin/cstecgi.cgi generates session tokens by computing MD5(time(NULL)), where time(NULL) returns the Unix timestamp at login. An unauthenticated attacker on the network can brute-force the token within a narrow time window (minutes) since the timestamp space is small and predictable. The attack requires network access but no prior authentication or user interaction. Successful exploitation grants the attacker full administrative privileges over the router, including the ability to read stored credentials (Wi-Fi PSK, PPPoE passwords), modify configuration and firewall rules, and perform denial-of-service. A public proof-of-concept exploit is available.
Affected products
- TOTOLINK N600R 4.3.0cu.7866_B20220506
Timeline
- 2026-08-30: disclosed: CVE published; exploit disclosed to public