A critical access control vulnerability in TOTOLINK T6 routers allows unauthenticated remote attackers to exfiltrate sensitive setup and onboarding configuration information.

This vulnerability involves incorrect access control within the getWizardCfg function, which permits an unauthenticated attacker to bypass security checks and access sensitive system configuration files via a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.

The exposure of setup and onboarding configuration data presents a significant risk to organizational and home network security. Unauthorized access to this information could reveal administrative credentials or network topology details, enabling further exploitation or persistent unauthorized access to the local network. With a CVSS score of 7.5, this high severity flaw requires immediate attention to prevent potential network compromise.

Immediate Action: Review the official TOTOLINK support portal for firmware updates addressing this flaw, as no specific patch version is currently confirmed. If no update is available, restrict access to the device management interface to trusted internal networks only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi, which may indicate an attempt to exploit the getWizardCfg function.

Compensating Controls: Implement strict firewall rules to prevent external access to the device management interface and disable remote administration features if they are not strictly necessary for operation.

Public Exploit Available: Unknown

Given the ability for unauthenticated attackers to extract sensitive configuration data, this vulnerability poses a substantial risk to device integrity. Administrators should prioritize securing the management interface of the affected TOTOLINK T6 hardware and monitor vendor channels for the release of a corrective firmware update.