A critical access control flaw in the TOTOLINK T6 router permits unauthenticated attackers to extract sensitive pairing and mesh-slave configuration data, posing a significant risk to network integrity.

The device suffers from improper access control within the getPairCfg function, which fails to enforce authentication. An unauthenticated attacker can exploit this by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to access configuration secrets.

The exposure of mesh configuration and pairing data allows unauthorized parties to map network topology or potentially gain deeper access into the internal environment. Given the high CVSS score of 9.1, this vulnerability presents a severe risk to organizational security, potentially leading to total compromise of the affected network segment.

Immediate Action: Review the TOTOLINK support portal for firmware updates addressing this flaw, as no official patch status is currently confirmed. If no update is available, isolate the affected device from the public-facing internet immediately.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at /cgi-bin/cstecgi.cgi, which may indicate attempts to enumerate or extract device configurations.

Compensating Controls: Implement strict firewall rules to restrict access to the management interface of the T6 router, ensuring that only trusted administrative IP addresses can reach the device.

Public Exploit Available: No (no confirmed public exploit available).

The severity of this vulnerability necessitates immediate attention to prevent unauthorized access to network configuration data. Administrators should prioritize restricting access to the device interface and monitor vendor communication channels closely for the release of a corrective firmware update.