Incorrect Access Control in TOTOLINK T6 Router

Executive Summary

This vulnerability is an incorrect access control issue in the setAccessDeviceCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to modify access-device policies by sending a specially crafted POST request to the vulnerable endpoint /cgi-bin/cstecgi.cgi.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthorized POST requests to /cgi-bin/cstecgi.cgi targeting the setAccessDeviceCfg function. Monitor network traffic for POST requests to this endpoint with parameters altering access-device policies. Check system logs for unusual POST requests to this path.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could exploit this to change network access policies, potentially allowing unauthorized devices to connect or blocking legitimate ones. This could disrupt network security and enable further attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to alter access-device policies, which could lead to unauthorized access to sensitive data or systems. Such unauthorized access may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by exposing personal or protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update TOTOLINK T6 firmware to the latest version if available. Block external access to /cgi-bin/cstecgi.cgi via firewall rules. Disable unnecessary services exposing this endpoint. Monitor for unauthorized changes to access-device policies.

Useful 0 Not Useful 0