TOTOLINK T6 vulnerabilities

Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via a crafted MQTT message to the cs_broker component.

Incorrect access control in the updatePriChannel function of TOTOLINK T6 allows unauthenticated attackers to rescan and switch the primary mesh channel via a crafted MQTT message to the cs_broker component.

Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces by sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 allows unauthenticated attackers to trigger mesh slave update coordination by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delVlanCfg function of TOTOLINK T6 allows unauthenticated attackers to remove VLAN entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

The delWiFiAclRules function in TOTOLINK T6 4.1.5cu.748_B20211015 has incorrect access control, allowing unauthenticated attackers to remove Wi-Fi ACL rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delDevice function of TOTOLINK T6 allows unauthenticated attackers to request deletion of a managed slave device by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 allows unauthenticated attackers to upload a crafted firmware image by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delParentalRules function of TOTOLINK T6 allows unauthenticated attackers to remove parental-control rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

The NTPSyncWithHost function in TOTOLINK T6 4.1.5cu.748_B20211015 has incorrect access control, allowing unauthenticated attackers to change the device clock via a crafted POST request to /cgi-bin/cstecgi.cgi.

In TOTOLINK T6 router version 4.1.5cu.748_B20211015, incorrect access control in the delSmartQosCfg function allows unauthenticated attackers to remove Smart QoS rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 allows unauthenticated attackers to install a custom CGI module via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setPairCfg function of TOTOLINK T6 allows unauthenticated attackers to alter the mesh pairing state via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to remove firewall filter rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 allows unauthenticated attackers to remove static DHCP reservations via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 allows unauthenticated attackers to change the device operating mode via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 allows unauthenticated attackers to remove MAC filter rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 allows unauthenticated attackers to manipulate WAN dial state via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 allows unauthenticated attackers to open a wireless pairing window via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setParentalRules function of TOTOLINK T6 allows unauthenticated attackers to alter parental-control behavior via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 allows unauthenticated attackers to change WPS availability via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 allows unauthenticated attackers to rename mesh entries via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setMacFilterRules function of TOTOLINK T6 allows unauthenticated attackers to change device access control by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 allows unauthenticated attackers to degrade wireless behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setDmzCfg function of TOTOLINK T6 allows unauthenticated attackers to expose an internal host by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to alter browsing policies by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setIptvCfg function of TOTOLINK T6 allows unauthenticated attackers to alter IPTV service configuration via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setPortForwardRules function of TOTOLINK T6 allows unauthenticated attackers to expose internal services via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 allows unauthenticated attackers to weaken edge filtering via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 allows unauthenticated attackers to establish or weaken guest wireless access via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setUploadSetting function of TOTOLINK T6 allows unauthenticated attackers to manipulate the upload or flash workflow via a crafted POST request to /cgi-bin/cstecgi.cgi.