Incorrect Access Control in TOTOLINK T6 Router

Executive Summary

This vulnerability is an incorrect access control issue in the getMacFilterRules function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to retrieve MAC filter rules by sending a specially crafted POST request to the vulnerable endpoint /cgi-bin/cstecgi.cgi.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /cgi-bin/cstecgi.cgi with parameters related to MAC filter rules. Check server logs for unauthorized access attempts to this endpoint. Use tools like tcpdump or Wireshark to capture and analyze HTTP POST requests targeting this path.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized access to network configuration details, potentially allowing them to bypass MAC filtering controls or gather sensitive network information without authentication.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the TOTOLINK T6 firmware to the latest version if a patch is available. Disable remote access to the web interface if not required. Restrict access to /cgi-bin/cstecgi.cgi via firewall rules. Monitor for unusual POST requests to this endpoint and block suspicious IPs.

Useful 0 Not Useful 0