Incorrect Access Control in TOTOLINK T6 Router Firmware

Executive Summary

This vulnerability is an incorrect access control issue in the setWiFiEasyCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to reconfigure or disable wireless networks by sending a specially crafted POST request to the vulnerable endpoint /cgi-bin/cstecgi.cgi.

Useful 0 Not Useful 0

Detection Guidance

Check if the device is running TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 or earlier. Inspect network traffic for POST requests to /cgi-bin/cstecgi.cgi with parameters related to WiFiEasyCfg. Monitor for unauthorized changes to wireless network settings.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to change Wi-Fi settings, disable your wireless network, or reconfigure it without authentication. This could lead to loss of internet access, unauthorized network changes, or potential exposure to further attacks if network security is weakened.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to reconfigure or disable wireless networks, which could lead to unauthorized access to network traffic. This may violate data protection requirements under GDPR and HIPAA by enabling eavesdropping or data interception.

Useful 0 Not Useful 0

Mitigation Strategies

Update the TOTOLINK T6 firmware to the latest version. Disable remote administration features if not needed. Restrict access to the device's web interface via network segmentation or firewall rules. Monitor network traffic for suspicious POST requests to /cgi-bin/cstecgi.cgi.

Useful 0 Not Useful 0