A high-severity access control vulnerability in TOTOLINK T6 routers allows unauthenticated remote attackers to exfiltrate internal network configuration details.

The device suffers from improper access control in the getLanCfg function. An unauthenticated attacker can trigger this flaw by sending a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint to leak network topology information.

The exposure of LAN addressing and DHCP configuration provides attackers with critical reconnaissance data necessary for lateral movement and targeted attacks against internal infrastructure. Given the CVSS score of 7.5, this vulnerability represents a significant risk to network privacy and security. Unauthorized access to these settings can facilitate further exploitation of internal devices that were previously hidden behind NAT or internal firewall segments.

Immediate Action: Consult the official TOTOLINK support portal for available firmware updates or security patches for the T6 model. If no patch is currently available, restrict access to the web management interface to trusted administrative IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /cgi-bin/cstecgi.cgi, specifically from unauthorized external sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an edge firewall to block direct internet access to the device management interface, effectively isolating the vulnerable CGI endpoint from public traffic.

Public Exploit Available: No.

The ability for an unauthenticated attacker to extract network configuration data constitutes a high-risk exposure for any organization utilizing the TOTOLINK T6. Security teams should prioritize isolating these devices from the public internet immediately and apply vendor-supplied firmware updates as soon as they are released to remediate the underlying access control failure.