CyberRota Analysis
AI-GeneratedTOTOLINK T6 version 4.1.5cu.748_B20211015 has an incorrect access control vulnerability in the getPasswordCfg function, enabling unauthenticated attackers to retrieve the administrative username by sending a specially crafted POST request to /cgi-bin/cstecgi.cgi. This exposure could lead to unauthorized access and potential compromise of the device. Network administrators and security teams managing affected TOTOLINK devices should prioritize this issue to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the administrative username via sending a crafted POST request to /cgi-bin/cstecgi.cgi.