Shengwu00

**Name of the Vulnerable Software and Affected Versions** TOTOLINK T6 version 4.1.5cu.748 B20211015 **Description** Incorrect access control in the `setScheduleCfg()` function allows unauthenticated attackers to configure forced reboot tasks. This is achieved by sending a crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK T6 version 4.1.5cu.748 B20211015 **Description** Incorrect access control in the `setWanIeCfg()` function allows unauthenticated attackers to reconfigure uplink settings. This is achieved by sending a crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK T6 version 4.1.5cu.748 B20211015 **Description** Incorrect access control in the `setAccessDeviceCfg()` function allows unauthenticated attackers to alter access-device policies. This is achieved by sending a crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK T6 version 4.1.5cu.748 B20211015 **Description** Incorrect access control in the `setLedCfg()` function allows unauthenticated attackers to modify LED behavior. This is achieved by sending a crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK T6 version 4.1.5cu.748 B20211015 **Description** Incorrect access control in the `setWiFiSignalCfg()` function allows unauthenticated attackers to reduce wireless power or cause a Denial of Service (DoS), which is a condition where the service becomes unavailable to its intended users. This is achieved by sending a crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK T6 version 4.1.5cu.748 B20211015 **Description** Incorrect access control in the `setUpgradeFW()` function allows unauthenticated attackers to trigger firmware-upgrade workflow changes. This is achieved by sending a crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint. **Recommendations** As a temporary workaround, restrict access to the '/cgi-bin/cstecgi.cgi' endpoint or disable the `setUpgradeFW()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK T6 version 4.1.5cu.748 B20211015 **Description** Incorrect access control in the `setWanCfg()` function allows unauthenticated attackers to alter upstream provisioning and connectivity. This is achieved by sending a crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK T6 version 4.1.5cu.748 B20211015 **Description** Incorrect access control in the `setStaticDhcpRules()` function allows unauthenticated attackers to add or modify static DHCP rules. This is achieved by sending a specially crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK T6 version 4.1.5cu.748 B20211015 **Description** Incorrect access control in the `setDdnsCfg()` function allows unauthenticated attackers to alter the dynamic DNS state. This is achieved by sending a crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter firewall policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK T6 version 4.1.5cu.748 B20211015 **Description** Incorrect access control in the `delUrlFilterRules()` function allows unauthenticated attackers to remove URL filtering rules. This is achieved by sending a crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK T6 version 4.1.5cu.748 B20211015 **Description** Incorrect access control in the `SystemSettings()` function allows unauthenticated attackers to retrieve administrative import and export endpoint information. This is achieved by sending a crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK T6 version 4.1.5cu.748 B20211015 **Description** Incorrect access control in the `UploadFirmwareFile()` function allows unauthenticated attackers to upload a crafted firmware image. This is achieved by sending a crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint. **Recommendations** As a temporary workaround, restrict access to the '/cgi-bin/cstecgi.cgi' endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.