Incorrect Access Control in TOTOLINK T6 Firmware

Executive Summary

This vulnerability is an incorrect access control issue in the LoadDefSettings function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to reset the device configuration and reboot the device by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /cgi-bin/cstecgi.cgi with parameters triggering the LoadDefSettings function. Check device logs for unauthorized configuration resets or reboots. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to reset your router to factory defaults, wiping all custom settings like Wi-Fi passwords and port forwarding rules. This could disrupt internet access and require manual reconfiguration. The attacker does not need any credentials to perform this action.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to reset device configurations and reboot the device, which could lead to unauthorized access or loss of sensitive data. Such unauthorized access may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by exposing personal or protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the TOTOLINK T6 firmware to the latest version. Disable remote access to the web interface if not required. Block external access to /cgi-bin/cstecgi.cgi via firewall rules. Monitor devices for unauthorized changes.

Useful 0 Not Useful 0