Unauthenticated Wi-Fi Schedule Deletion in TOTOLINK T6 Firmware

Executive Summary

This vulnerability is an incorrect access control issue in the FirmwareUpgrade function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a specially crafted POST request to the vulnerable endpoint /cgi-bin/cstecgi.cgi.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /cgi-bin/cstecgi.cgi with parameters related to Wi-Fi schedule removal. Check server logs for unauthorized access attempts to this endpoint.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to disrupt Wi-Fi schedules, potentially causing network downtime or unauthorized access. Since no authentication is required, any remote attacker can manipulate these settings without needing credentials.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to modify Wi-Fi schedule entries, which could lead to unauthorized network access. This may impact compliance with standards requiring strict access controls, such as GDPR (data protection) or HIPAA (healthcare data security), by enabling unauthorized changes to network configurations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the TOTOLINK T6 firmware to the latest version. Disable remote access to the web interface if not required. Implement network segmentation to limit exposure of vulnerable devices.

Useful 0 Not Useful 0