Unauthenticated Access to Port-Forwarding Rules in TOTOLINK T6

Executive Summary

This vulnerability is an incorrect access control issue in the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to retrieve port-forwarding rules by sending a specially crafted POST request to the vulnerable endpoint /cgi-bin/cstecgi.cgi.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if unauthenticated POST requests to /cgi-bin/cstecgi.cgi return port-forwarding rules. Use tools like curl to send a crafted request: curl -X POST http://<TARGET_IP>/cgi-bin/cstecgi.cgi --data 'command=getPortForwardRules'. If the response contains port-forwarding data without authentication, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain sensitive network information, such as internal port mappings, which may help in further attacks like unauthorized access or lateral movement within the network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to obtain port-forwarding rules, which could expose sensitive network configurations. Such exposure may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information).

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the TOTOLINK T6 firmware to the latest patched version. If no patch is available, restrict access to the /cgi-bin/cstecgi.cgi endpoint via firewall rules or disable remote administration. Monitor network traffic for suspicious POST requests to this path.

Useful 0 Not Useful 0