TOTOLINK T6 vulnerabilities

Incorrect access control in the setWanCfg function of TOTOLINK T6 allows unauthenticated attackers to alter WAN configuration and connectivity via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 allows unauthenticated attackers to create or weaken guest wireless access via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 allows unauthenticated attackers to reconfigure or disable wireless networks via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setStorageCfg function of TOTOLINK T6 allows unauthenticated attackers to alter the storage-related service state via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 allows unauthenticated attackers to expose WAN-side administration via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setLedCfg function of TOTOLINK T6 allows unauthenticated attackers to modify LED behavior via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 allows unauthenticated attackers to change the administrator account via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 allows unauthenticated attackers to change UPnP service state via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 allows unauthenticated attackers to alter access-device policies via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 allows unauthenticated attackers to reconfigure uplink settings via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to configure forced reboot tasks via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain the roaming enablement flag via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 allows unauthenticated attackers to query slave upgrade status and affect upgrade bookkeeping via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getPairCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain pairing and mesh-slave configuration via a crafted POST request to /cgi-bin/cstecgi.cgi.

TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getWiFiApcliScan function, allowing unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getPortForwardRules function, allowing unauthenticated attackers to obtain port-forwarding rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain IP and port filtering rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getSyslogCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain syslog-related configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getParentalRules function of TOTOLINK T6 allows unauthenticated attackers to obtain parental-control rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getPasswordCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain the administrative username via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getNtpCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain NTP configuration and current time data via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 allows unauthenticated attackers to obtain Wi-Fi ACL rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 allows unauthenticated attackers to generate and retrieve a new WPS PIN via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWanCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain WAN configuration data via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the startSlaveReboot function of TOTOLINK T6 allows unauthenticated attackers to arbitrarily force a reboot via a crafted MQTT message.

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the setDevReboot function of TOTOLINK T6 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via a crafted MQTT message to the cs_broker component.

TOTOLINK T6 version 4.1.5cu.748_B20211015 has an incorrect access control vulnerability in the updateLanIp function. Unauthenticated attackers can refresh the LAN address state by sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the cs_broker component.

TOTOLINK T6 version 4.1.5cu.748_B20211015 has an incorrect access control vulnerability in the staticInfoSend function. Unauthenticated attackers can trigger static information reporting to the configured master by sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 allows unauthenticated attackers to update stored slave inventory records via a crafted MQTT message to the cs_broker component.

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger WAN discovery logic by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the showSyslog function of TOTOLINK T6 allows unauthenticated attackers to retrieve recent system logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the SystemSettings function of TOTOLINK T6 allows unauthenticated attackers to retrieve administrative import and export endpoint information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to remove URL filtering rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delPortForwardRules function of TOTOLINK T6 allows unauthenticated attackers to delete port-forwarding rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setRoamingCfg function of TOTOLINK T6 allows unauthenticated attackers to alter roaming behavior via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 allows unauthenticated attackers to alter wireless availability windows via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 allows unauthenticated attackers to degrade traffic handling via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 allows unauthenticated attackers to alter mesh configurations via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to alter Wi-Fi availability schedule by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to alter firewall policies by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 allows unauthenticated attackers to alter dynamic DNS state via a crafted POST request to /cgi-bin/cstecgi.cgi.