Incorrect Access Control in TOTOLINK T6 Firmware

Executive Summary

This vulnerability is an incorrect access control issue in the getWiFiEasyGuestCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to retrieve simplified guest Wi-Fi configuration details, including guest credentials, by sending a specially crafted POST request to the vulnerable endpoint /cgi-bin/cstecgi.cgi.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /cgi-bin/cstecgi.cgi. Check if unauthenticated requests are accessing the getWiFiEasyGuestCfg function. Use tools like tcpdump or Wireshark to capture and analyze traffic to this endpoint.

Useful 0 Not Useful 0

Impact Analysis

If you use a TOTOLINK T6 router with the affected firmware, attackers could exploit this flaw to gain access to your guest Wi-Fi network credentials. This could allow unauthorized users to connect to your guest network, potentially consuming bandwidth, accessing shared resources, or performing malicious activities while appearing to originate from your network.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the TOTOLINK T6 firmware to the latest version. Disable guest Wi-Fi if not in use. Restrict access to the /cgi-bin/cstecgi.cgi endpoint via firewall rules. Monitor logs for suspicious POST requests to this path.

Useful 0 Not Useful 0