Incorrect Access Control in TOTOLINK T6 Router Firmware

Executive Summary

This vulnerability is an incorrect access control issue in the setPasswordCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to change the administrator account password by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.

Useful 0 Not Useful 0

Detection Guidance

Detect this vulnerability by checking if unauthenticated POST requests to /cgi-bin/cstecgi.cgi are modifying administrator account settings. Monitor network traffic for suspicious POST requests targeting this endpoint.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full administrative control over the affected TOTOLINK T6 device without needing valid credentials. This could lead to unauthorized network access, configuration changes, or potential further attacks through the compromised device.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated access to sensitive network configuration data, which could lead to unauthorized exposure of personal or sensitive information. Such breaches may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized access to protected information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the TOTOLINK T6 firmware to the latest version. Block external access to the /cgi-bin/cstecgi.cgi endpoint via firewall rules. Disable unnecessary services and restrict network access to the device.

Useful 0 Not Useful 0