A critical access control vulnerability in the TOTOLINK T6 router allows unauthenticated attackers to bypass security restrictions and access sensitive configuration data.

The vulnerability exists within the getRoamingCfg function, which fails to perform necessary authentication checks. An unauthenticated attacker can exploit this by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to retrieve the roaming enablement flag.

The exploitation of this vulnerability poses a severe risk to network integrity and confidentiality. By obtaining internal configuration flags, an unauthorized actor could potentially gain insights into the network architecture or prepare for secondary attacks, leading to unauthorized access and potential compromise of connected internal systems. With a CVSS score of 9.1, this flaw is categorized as critical, necessitating immediate attention to prevent potential exploitation.

Immediate Action: Review the official TOTOLINK support portal for firmware updates addressing this flaw and apply the latest version as soon as it becomes available.

Proactive Monitoring: Monitor network traffic for suspicious POST requests targeting the /cgi-bin/cstecgi.cgi path on the affected device.

Compensating Controls: Ensure the administration interface is not exposed to the public internet by utilizing firewall rules to restrict management access to trusted internal IP addresses only.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-ups linked in the enrichment data.

Given the critical nature of this vulnerability and the availability of public technical details, administrators must treat this as a high-priority risk. If a vendor-supplied patch is not yet available, restrict network access to the device management interface immediately to minimize the attack surface until a permanent fix can be applied.