A high-severity access control vulnerability in TOTOLINK T6 routers enables unauthenticated attackers to exfiltrate sensitive network topology and interface configuration information.

The vulnerability exists in the getNetInfoCfg function, which fails to perform necessary authentication checks. An unauthenticated attacker can exploit this by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to bypass security controls.

Successful exploitation allows an unauthorized party to gain deep visibility into the internal network structure of the organization. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to confidentiality, potentially facilitating further targeted attacks against network infrastructure and internal assets by providing attackers with the intelligence required to map the environment.

Immediate Action: Contact TOTOLINK support to verify if a firmware patch is available for the T6 model, as no public fix was confirmed at the time of analysis. If no patch exists, restrict access to the web management interface to trusted management subnets only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi, specifically looking for repetitive queries or requests originating from external or untrusted IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to inspect and block unauthorized POST requests targeting the identified CGI endpoint.

Public Exploit Available: Unknown

Given that this vulnerability allows unauthenticated access to critical network configuration data, immediate mitigation is required. Administrators should prioritize restricting network access to the device management interface to prevent external exploitation while awaiting official vendor guidance or firmware updates.