A critical access control flaw in the TOTOLINK T6 router enables unauthenticated remote attackers to obtain sensitive system configuration and logs.

This vulnerability exists within the getDiagnosisCfg function, which fails to perform necessary authentication checks. Attackers can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to retrieve sensitive diagnostic data.

The exposure of diagnostic configuration and ping logs can lead to the compromise of internal network topology, IP addressing schemes, and potentially other sensitive system parameters. Given the CVSS score of 9.1, this vulnerability presents a critical risk, as it allows for trivial information gathering by remote, unauthenticated actors that can facilitate further network attacks.

Immediate Action: Review the official TOTOLINK support portal for firmware updates addressing this flaw, or restrict access to the web management interface to trusted internal networks only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi, particularly from external or untrusted sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network filtering rule to block unauthorized access to the /cgi-bin/cstecgi.cgi endpoint.

Public Exploit Available: No (no confirmed weaponized exploit or public proof-of-concept repository identified in provided sources).

Due to the critical severity and the ease of exploitation, immediate action is required to secure affected TOTOLINK T6 devices. Administrators should prioritize restricting management interface access and applying vendor-supplied patches as soon as they are released to prevent potential reconnaissance and subsequent network compromise.