TOTOLINK A3700R Improper Access Control Vulnerability in Password Handler

A critical improper access control vulnerability has been identified in the TOTOLINK A3700R router, specifically in version 9.1.2u.5822_B20200513. The issue arises in the web management interface within the Password Handler component, particularly in the functions setWiFiEasyCfg and setWiFiEasyGuestCfg. This vulnerability allows remote attackers to manipulate access controls by sending unauthenticated HTTP POST requests to the /cgi-bin/cstecgi.cgi file, effectively enabling them to alter the device's password service.

Impact

Exploitation of this vulnerability allows for unauthorized modification of the device's password service, potentially leading to unauthorized access or control over the device.

Reproduction

To reproduce this vulnerability, send an unauthenticated HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint. Include the setWiFiEasyCfg or setWiFiEasyGuestCfg header to manipulate the password service of the device.