A critical memory corruption vulnerability in TOTOLINK T6 routers allows unauthenticated remote attackers to execute arbitrary code.

The vulnerability exists within the setDiagnosisCfg function of the cstecgi.cgi script, where the ip parameter is processed without sufficient length validation. By sending a malicious HTTP POST request, an attacker can trigger a buffer overflow, overwrite the return address, and execute arbitrary code on the device.

Successful exploitation of this vulnerability allows a remote attacker to gain full control over the affected router, leading to complete compromise of network traffic, unauthorized access to internal resources, and potential persistence within the network. With a CVSS score of 8.8, this flaw represents a significant risk to organizational infrastructure, as it facilitates remote code execution without requiring complex prerequisites.

Immediate Action: Users should immediately check for and apply the latest firmware updates provided by the manufacturer to address this memory corruption flaw.

Proactive Monitoring: Security teams should monitor network traffic for suspicious HTTP POST requests directed at the cstecgi.cgi endpoint and investigate any unusual outbound connections originating from the router, such as unexpected telnet sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an intrusion detection system with rules configured to inspect and block malformed HTTP POST requests containing oversized payloads sent to the setDiagnosisCfg function.

Public Exploit Available: Yes, a functional proof-of-concept exploit is available via the researcher's published technical write-up on GitHub.

Given the severity of this remote code execution vulnerability and the availability of a functional proof-of-concept, immediate remediation is required. Organizations utilizing the TOTOLINK T6 should prioritize firmware updates and isolate affected devices from the public internet until patches are applied to prevent potential compromise.