TOTOLINK T6 vulnerabilities

TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getTracerouteCfg function, allowing unauthenticated attackers to obtain traceroute diagnostic logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getTelnetCfg function, allowing unauthenticated attackers to obtain Telnet service enablement status information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getWiFiApcliScan function, allowing unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getCloudSrvCheckStatus function, allowing unauthenticated attackers to obtain cloud firmware check status information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getPortForwardRules function, allowing unauthenticated attackers to obtain port-forwarding rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain IP and port filtering rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getDmzCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getSyslogCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain syslog-related configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getMacFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain MAC filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain schedule or scheduled-reboot configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getStorageCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain storage feature state information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getUPnPCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain Smart QoS configuration and rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getRemoteCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain remote-management enablement and port information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWanInfo function of TOTOLINK T6 allows unauthenticated attackers to obtain WAN information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getCrpcCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain cloud remote-control status and URL information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getParentalRules function of TOTOLINK T6 allows unauthenticated attackers to obtain parental-control rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getPasswordCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain the administrative username via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getCrpcConfig function of TOTOLINK T6 allows unauthenticated attackers to obtain cloud remote-control status and URL information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getNtpCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain NTP configuration and current time data via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh routing information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh configuration and runtime state information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh neighbor information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain AP-specific Wi-Fi scheduling rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain guest Wi-Fi configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh portal table information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 allows unauthenticated attackers to obtain Wi-Fi ACL rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain Wi-Fi scheduling rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain advanced wireless settings via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 allows unauthenticated attackers to obtain WPS runtime status via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getDdnsCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 allows unauthenticated attackers to obtain static DHCP reservation rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 allows unauthenticated attackers to generate and retrieve a new WPS PIN via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getIptvCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getStationMacByIp function of TOTOLINK T6 allows unauthenticated attackers to obtain a client MAC address via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getDdnsStatus function of TOTOLINK T6 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWanCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain WAN configuration data via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getInitCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain sensitive device configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain network topology and interface configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getOnlineClient function of TOTOLINK T6 allows unauthenticated attackers to obtain online client information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWizardCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWanIeCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.