BaseFortify

Executive Summary

This vulnerability is an incorrect access control issue in the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to modify firewall policies by sending a specially crafted POST request to the device's web interface at /cgi-bin/cstecgi.cgi. The flaw exists in the setIpPortFilterRules function, which should restrict access but fails to do so properly.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /cgi-bin/cstecgi.cgi with parameters targeting setIpPortFilterRules. Check firewall logs for unauthorized changes to rules. Use tools like Wireshark to inspect HTTP POST requests to this endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to bypass firewall protections, potentially enabling unauthorized access to your network or devices. Attackers might disable security rules, open ports for further attacks, or disrupt network traffic. Since it requires no authentication, any device exposed to the internet with this firmware version is at risk.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the TOTOLINK T6 firmware to the latest version. Disable remote administration if not needed. Restrict access to the web interface via firewall rules. Monitor firewall configurations for unauthorized changes.

Useful 0 Not Useful 0