CyberRota Analysis
AI-GeneratedTOTOLINK T6 versions prior to 4.1.5cu.748_B20211015 are vulnerable due to incorrect access control in the setPasswordCfg function, enabling unauthenticated attackers to change the administrator password through a crafted POST request. This vulnerability poses a significant risk as it allows unauthorized access to the device's administrative functions. Network administrators and security teams managing affected devices should prioritize remediation to prevent potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi.